CVE-2026-45191 Security feature bypass in Net::CIDR::Lite
Attackers can bypass IP access controls by using padded CIDR masks, affecting applications relying on Net::CIDR::Lite for network filtering.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-45191?
CVE-2026-45191 is a medium-severity vulnerability in STIGTSP Net::CIDR::Lite, published on 10 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Net::CIDR::Lite versions before 0.24 for Perl does not properly consider extraneous zero characters in CIDR mask values, which may allow IP ACL bypass.
Mask forms like "/00" and "/01" pass validation and parse to the same prefix as their unpadded value.
See also CVE-2026-45190.
Weakness: CWE-1289
Which versions are affected by CVE-2026-45191?
How do I fix CVE-2026-45191?
Upgrade to a fixed version.
Is CVE-2026-45191 being exploited?
There is no known exploitation of CVE-2026-45191 in the wild and no public exploit code.
Sources
Also known as ALPINE-CVE-2026-45191, AZL-86417, DEBIAN-CVE-2026-45191, GHSA-fw62-67j2-4wmc, UBUNTU-CVE-2026-45191.