CVE-2026-49941: Net::CIDR::Set versions through 0.20 for Perl did not validate IP addresses
Net::CIDR::Set versions through 0.20 for Perl did not validate IP addresses.
The add method called the encode method to parse addresses. If the addresses did not look like netmasks or network ranges, then they were assumed to single IP addresses and passed back to itself as a 32-bit or 128-bit netmask.
If the argument was not a well-formed IP address, then this would lead to indefinite recursion.
An attacker could use this to cause a denial of service.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Net::CIDR::Set (Perl)to a version that resolves this vulnerability.Fixed in 0.21
Event History
Frequently Asked Questions
What is the severity of CVE-2026-49941?
The severity of CVE-2026-49941 is high, with a CVSS score of 7.5.
How do I fix CVE-2026-49941?
To fix CVE-2026-49941, upgrade to version 0.21 or later of Net::CIDR::Set.
What does CVE-2026-49941 impact?
CVE-2026-49941 impacts versions of Net::CIDR::Set for Perl prior to 0.21.
What is the main issue described in CVE-2026-49941?
The main issue in CVE-2026-49941 is that the affected versions did not properly validate IP addresses.
When was CVE-2026-49941 published?
CVE-2026-49941 was published on June 4, 2026.