CVE-2026-86287: high-severity vulnerability in Net-IP-LPM
Net::IP::LPM versions before 1.12 for Perl accept malformed prefix lengths
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 7.5epss 0.6%
Net::IP::LPM versions before 1.12 for Perl accept malformed prefix lengths.
Non-numeric and non-ASCII prefix lengths are accepted and treated as 0. Integers over 31 bits are silently truncated. A single malformed mask will poison the lookup table.
The result is that the lookup will silently succeed for every address. An allow-list will allow every address, and a deny-list will block every address.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected products
Net-IP-LPMRelated CVEs — Net-IP-LPM
In the same product, most dangerous first.
CVE-2026-56015CRITICALNet::IP::LPM versions before 1.11 for Perl allow a heap out-of-bounds read via an unbounded prefix lengthEPSS 0.7%CVE-2025-40910MEDIUMNet::IP::LPM version 1.10 for Perl does not properly consider leading zero characters in IP CIDR address strings, which could allow attackers to bypass access control that is based on IP addressesEPSS 0.3%