CVE-2026-49940: Net::CIDR::Set versions through 0.20 for Perl accept non-ASCII IP addresses and netmasks
Net::CIDR::Set versions through 0.20 for Perl accept non-ASCII IP addresses and netmasks.
Unicode digits such as the Arabic-Indic One (U+0661) were accepted but not properly parsed as numbers. This could allow network masks to accept larger networks.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Net::CIDR::Set (Perl)to a version that resolves this vulnerability.Fixed in 0.21
Event History
Frequently Asked Questions
What is the severity of CVE-2026-49940?
The severity of CVE-2026-49940 is medium with a CVSS score of 6.5.
How do I fix CVE-2026-49940?
To fix CVE-2026-49940, upgrade to Net::CIDR::Set version 0.21 or later.
What software is affected by CVE-2026-49940?
CVE-2026-49940 affects the Net::CIDR::Set versions through 0.20 for Perl.
What type of issue is described in CVE-2026-49940?
CVE-2026-49940 describes an issue where non-ASCII IP addresses and netmasks are accepted but not properly parsed.
What is the potential risk of CVE-2026-49940?
The potential risk of CVE-2026-49940 is that network masks could accept larger networks due to improper parsing of Unicode digits.