CVE-2026-45190 Security feature bypass in Net::CIDR::Lite

Medium 6.5 Published 10 May 2026 Updated 12 May 2026

Attackers can bypass IP-based access controls in applications using Net::CIDR::Lite by exploiting improper input validation of IP addresses and CIDR masks.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2026-45190?

CVE-2026-45190 is a medium-severity vulnerability in STIGTSP Net::CIDR::Lite, published on 10 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Net::CIDR::Lite versions before 0.24 for Perl does not properly validate IP address and CIDR mask inputs, which may allow IP ACL bypass.

Inputs containing a trailing newline or non-ASCII digit characters pass the validators but are then re-encoded by the parser to a different address than the input string spelled. find() and bin_find() can match or miss addresses as a result.

Example:

my $cidr = Net::CIDR::Lite->new(); $cidr->add("::1\n/128"); $cidr->find("::1a"); # incorrectly returns true

Which versions are affected by CVE-2026-45190?

How do I fix CVE-2026-45190?

Upgrade to a fixed version.

Is CVE-2026-45190 being exploited?

There is no known exploitation of CVE-2026-45190 in the wild and no public exploit code.

Sources

Also known as ALPINE-CVE-2026-45190, AZL-86414, DEBIAN-CVE-2026-45190, GHSA-5vf8-328m-mxj5, UBUNTU-CVE-2026-45190.