CVE-2026-49941 Net::CIDR::Set versions through 0.20 for Perl did not validate IP addresses
An attacker can cause a denial of service in Perl applications using Net::CIDR::Set by providing malformed IP addresses that trigger indefinite recursion.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-49941?
CVE-2026-49941 is a high-severity denial of service vulnerability in RRWO Net::CIDR::Set, published on 4 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Net::CIDR::Set versions through 0.20 for Perl did not validate IP addresses.
The add method called the _encode method to parse addresses. If the addresses did not look like netmasks or network ranges, then they were assumed to single IP addresses and passed back to itself as a 32-bit or 128-bit netmask.
If the argument was not a well-formed IP address, then this would lead to indefinite recursion.
An attacker could use this to cause a denial of service.
Which versions are affected by CVE-2026-49941?
It affects 1 product.
Products include Rrwo Net\.
How do I fix CVE-2026-49941?
Upgrade to a fixed version.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-49941 being exploited?
There is no known exploitation of CVE-2026-49941 in the wild and no public exploit code.
Other vulnerabilities in RRWO Net::CIDR::Set
Sources
Also known as DEBIAN-CVE-2026-49941, GHSA-wvxw-q92g-9ghf, UBUNTU-CVE-2026-49941.