CVE-2026-49940

MediumCVSS 6.5/10Last modified Jul 22, 2026

Description

Net::CIDR::Set versions through 0.20 for Perl accept non-ASCII IP addresses and netmasks.

Unicode digits such as the Arabic-Indic One (U+0661) were accepted but not properly parsed as numbers. This could allow network masks to accept larger networks.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-1289

Affected software

Vendor	Product	Versions
RRWO	Net::CIDR::Set	<= 0.20

References

https://metacpan.org/release/RRWO/Net-CIDR-Set-0.21/changesRelease Notes
https://nvd.nist.gov/vuln/detail/CVE-2025-40911Third Party Advisory, US Government Resource

Timeline

Published: Jun 4, 2026
Last modified: Jul 22, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-499417.5Net::CIDR::Set versions through 0.20 for Perl did not validate IP addresses. The add method called the _encode method to parse addresses. I CVE-2026-499427.3Net::CIDR::Set versions through 0.20 for Perl did not validate network masks. The mask portion of a network mask could contain Unicode digi CVE-2026-499436.3CZ.NIC BIRD Internet Routing Daemon through 2.19.0 contains a stack-based buffer overflow in the BGP AS_PATH mask matching implementation in CVE-2026-499488.1Mem0 versions through 0.2.8, fixed in commit ae7f406, contain a missing authorization vulnerability in the self-hosted server component wher CVE-2026-499495.3CodexBar before 0.33.0 contains a credential forwarding vulnerability that allows network-adjacent attackers to intercept sensitive credenti CVE-2026-49953.5A vulnerability was determined in wandb OpenUI up to 1.0. Affected by this vulnerability is an unknown functionality of the file frontend/pu CVE-2026-499509.8Xorbits Xoscar through 0.11.2 contains an unauthenticated deserialization vulnerability that allows remote attackers to execute arbitrary co CVE-2026-499516.3RAGFlow before 0.27.0 contains a server-side request forgery vulnerability that allows authenticated attackers to force the server to issue CVE-2026-499529.1Discuz! X5.0 releases 20260320 through 20260501 contains an authentication bypass vulnerability that allows unauthenticated remote attackers CVE-2026-499536.5Discuz! X5.0 releases 20260320 through 20260610 contains a CAPTCHA bypass vulnerability that allows unauthenticated remote attackers to defe CVE-2026-499547.2Discuz! X5.0 releases 20260320 through 20260610 contain a local file inclusion vulnerability that allows authenticated administrators to exe CVE-2026-499555.3Hermes WebUI before version 0.51.270 contains a resource exhaustion vulnerability that allows unauthenticated remote attackers to degrade se