CVE-2026-40199 Net::CIDR::Lite versions before 0.23 for Perl mishandles IPv4 mapped IPv6 addresses, which may allow IP ACL bypass
Attackers can bypass IP-based access controls by exploiting incorrect handling of IPv4-mapped IPv6 addresses in the Net::CIDR::Lite Perl library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-40199?
CVE-2026-40199 is a medium-severity vulnerability in STIGTSP Net::CIDR::Lite, published on 10 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Net::CIDR::Lite versions before 0.23 for Perl mishandles IPv4 mapped IPv6 addresses, which may allow IP ACL bypass.
_pack_ipv6() includes the sentinel byte from _pack_ipv4() when building the packed representation of IPv4 mapped addresses like ::ffff:192.168.1.1. This produces an 18 byte value instead of 17 bytes, misaligning the IPv4 part of the address.
The wrong length causes incorrect results in mask operations (bitwise AND truncates to the shorter operand) and in find() / bin_find() which use Perl string comparison (lt/gt). This can cause find() to incorrectly match or miss addresses.
Example:
my $cidr = Net::CIDR::Lite->new("::ffff:192.168.1.0/120"); $cidr->find("::ffff:192.168.2.0"); # incorrectly returns true
This is triggered by valid RFC 4291 IPv4 mapped addresses (::ffff:x.x.x.x).
See also CVE-2026-40198, a related issue in the same function affecting malformed IPv6 addresses.
Weakness: CWE-130
Which versions are affected by CVE-2026-40199?
It affects 1 product.
Products include Stigtsp Net\.
How do I fix CVE-2026-40199?
Upgrade to a fixed version.
Is CVE-2026-40199 being exploited?
There is no known exploitation of CVE-2026-40199 in the wild and no public exploit code.
Other vulnerabilities in STIGTSP Net::CIDR::Lite
Sources
Also known as ALPINE-CVE-2026-40199, AZL-82742, DEBIAN-CVE-2026-40199, GHSA-932w-96j4-j35v, UBUNTU-CVE-2026-40199.