CPANSA-Net-CIDR-Set-2025-40911: Net-CIDR-Set vulnerability
| Publisher | giterlizzi | Document category | csaf_security_advisory |
|---|---|---|---|
| Initial release date | 2025-05-27T00:00:00 | Engine | CSAF Perl Toolkit 0.25 |
| Current release date | 2025-05-27T00:00:00 | Build Date | |
| Current version | 1 | Status | final |
| CVSS v3.1 Base Score | 6.5 | Severity | |
| Original language | Language | en | |
| Also referred to | |||
Vulnerability Description
Net::CIDR::Set versions 0.10 through 0.13 for Perl does not properly handle leading zero characters in IP CIDR address strings, which could allow attackers to bypass access control that is based on IP addresses. Leading zeros are used to indicate octal numbers, which can confuse users who are intentionally using octal notation, as well as users who believe they are using decimal notation. Net::CIDR::Set used code from Net::CIDR::Lite, which had a similar vulnerability CVE-2021-47154.
Vulnerabilities
CVE-2025-40911
Vulnerability DescriptionNet::CIDR::Set versions 0.10 through 0.13 for Perl does not properly handle leading zero characters in IP CIDR address strings, which could allow attackers to bypass access control that is based on IP addresses.
Leading zeros are used to indicate octal numbers, which can confuse users who are intentionally using octal notation, as well as users who believe they are using decimal notation.
Net::CIDR::Set used code from Net::CIDR::Lite, which had a similar vulnerability CVE-2021-47154.
| Weakness | CWE-1287 : Improper Validation of Specified Type of Input |
|---|
Product status
Known affected
| Product | Score | ||||||||
|---|---|---|---|---|---|---|---|---|---|
| Net-CIDR-Set greater than or equal 0.10 and less than or equal 0.13 |
|
Fixed
- Net-CIDR-Set greater than or equal 0.14
giterlizzi
Namespace: https://github.com/giterlizzi/
gdt@cpan.org
References
- CPANSA-Net-CIDR-Set-2025-40911 JSON self
https://raw.githubusercontent.com/giterlizzi/perl-CPANSA-CSAF/develop/csaf/white/2025/cpansa-net-cidr-set-2025-40911.json - https://blog.urth.org/2021/03/29/security-issues-in-perl-ip-address-distros/ external
https://blog.urth.org/2021/03/29/security-issues-in-perl-ip-address-distros/ - https://github.com/robrwo/perl-Net-CIDR-Set/commit/be7d91e8446ad8013b08b4be313d666dab003a8a.patch external
https://github.com/robrwo/perl-Net-CIDR-Set/commit/be7d91e8446ad8013b08b4be313d666dab003a8a.patch - https://metacpan.org/release/RRWO/Net-CIDR-Set-0.14/changes external
https://metacpan.org/release/RRWO/Net-CIDR-Set-0.14/changes - CVE-2025-40911 (NVD) external
https://nvd.nist.gov/vuln/detail/CVE-2025-40911
Revision history
| Version | Date of the revision | Summary of the revision |
|---|---|---|
| 1 | Tue May 27 00:00:00 2025 | First release |
Sharing rules
TLP:WHITE
For the TLP version see: https://www.first.org/tlp/