CVE-2026-86287: fallo de gravedad alta en Net-IP-LPM
Net::IP::LPM versions before 1.12 for Perl accept malformed prefix lengths
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
21Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 7.5epss 0.6%
Net::IP::LPM versions before 1.12 for Perl accept malformed prefix lengths.
Non-numeric and non-ASCII prefix lengths are accepted and treated as 0. Integers over 31 bits are silently truncated. A single malformed mask will poison the lookup table.
The result is that the lookup will silently succeed for every address. An allow-list will allow every address, and a deny-list will block every address.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Productos afectados
Net-IP-LPMCVEs relacionadas — Net-IP-LPM
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-56015CRITICALNet::IP::LPM versions before 1.11 for Perl allow a heap out-of-bounds read via an unbounded prefix lengthEPSS 0.7%CVE-2025-40910MEDIUMNet::IP::LPM version 1.10 for Perl does not properly consider leading zero characters in IP CIDR address strings, which could allow attackers to bypass access control that is based on IP addressesEPSS 0.3%