CVE-2026-49942 Net::CIDR::Set versions through 0.20 for Perl did not validate network masks
Attackers can bypass network restrictions by using Unicode digits or leading zeros in CIDR masks, allowing access to larger networks than intended.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-49942?
CVE-2026-49942 is a high-severity vulnerability in RRWO Net::CIDR::Set, published on 4 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Net::CIDR::Set versions through 0.20 for Perl did not validate network masks.
The mask portion of a network mask could contain Unicode digits such as the Arabic-Indic One (U+0661), or non-digits, which were ignored. This could allow network masks to accept larger networks.
Leading zeros were also accepted, but treated as decimal instead of octal. This could lead to confusion about what networks are acceptable.
Weakness: CWE-1289
Which versions are affected by CVE-2026-49942?
It affects 1 product.
Products include Rrwo Net\.
How do I fix CVE-2026-49942?
Upgrade to a fixed version.
Is CVE-2026-49942 being exploited?
There is no known exploitation of CVE-2026-49942 in the wild and no public exploit code.
Other vulnerabilities in RRWO Net::CIDR::Set
Sources
Also known as DEBIAN-CVE-2026-49942, GHSA-fff7-gx98-vr3g, UBUNTU-CVE-2026-49942.