CVE-2026-49942: Net::CIDR::Set versions through 0.20 for Perl did not validate network masks
Net::CIDR::Set versions through 0.20 for Perl did not validate network masks.
The mask portion of a network mask could contain Unicode digits such as the Arabic-Indic One (U+0661), or non-digits, which were ignored. This could allow network masks to accept larger networks.
Leading zeros were also accepted, but treated as decimal instead of octal. This could lead to confusion about what networks are acceptable.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Net::CIDR::Set (Perl)to a version that resolves this vulnerability.Fixed in 0.21
Event History
Frequently Asked Questions
What is the severity of CVE-2026-49942?
The severity of CVE-2026-49942 is rated high with a CVSS score of 7.3.
How do I fix CVE-2026-49942?
To fix CVE-2026-49942, you should upgrade to Net::CIDR::Set version 0.21 or later.
What does CVE-2026-49942 affect?
CVE-2026-49942 affects versions of Net::CIDR::Set for Perl up to and including 0.20.
What is the risk associated with CVE-2026-49942?
CVE-2026-49942 carries a risk rating of 54, indicating potential security vulnerabilities.
What vulnerabilities does CVE-2026-49942 introduce?
CVE-2026-49942 allows network masks to accept larger networks due to improper validation of network masks.