CVE-2026-49940 Net::CIDR::Set versions through 0.20 for Perl accept non-ASCII IP addresses and netmasks
Attackers can bypass network access controls by using non-ASCII Unicode digits in IP addresses and netmasks, causing incorrect parsing of network ranges.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-49940?
CVE-2026-49940 is a medium-severity vulnerability in RRWO Net::CIDR::Set, published on 4 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Net::CIDR::Set versions through 0.20 for Perl accept non-ASCII IP addresses and netmasks.
Unicode digits such as the Arabic-Indic One (U+0661) were accepted but not properly parsed as numbers. This could allow network masks to accept larger networks.
Weakness: CWE-1289
Which versions are affected by CVE-2026-49940?
It affects 1 product.
Products include Rrwo Net\.
How do I fix CVE-2026-49940?
Upgrade to a fixed version.
Is CVE-2026-49940 being exploited?
There is no known exploitation of CVE-2026-49940 in the wild and no public exploit code.
Other vulnerabilities in RRWO Net::CIDR::Set
Sources
Also known as DEBIAN-CVE-2026-49940, GHSA-hpv8-77xm-27wx, UBUNTU-CVE-2026-49940.