CVE-2026-86287: Net::IP::LPM versions before 1.12 for Perl accept malformed prefix lengths
Net::IP::LPM versions before 1.12 for Perl accept malformed prefix lengths.
Non-numeric and non-ASCII prefix lengths are accepted and treated as 0. Integers over 31 bits are silently truncated. A single malformed mask will poison the lookup table.
The result is that the lookup will silently succeed for every address. An allow-list will allow every address, and a deny-list will block every address.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Net::IP::LPM (Perl)to a version that resolves this vulnerability.Fixed in 1.12
Event History
Frequently Asked Questions
Which installations need to be updated?
Installations using Net::IP::LPM for Perl before version 1.12 are affected. Updating to version 1.12 or later addresses the malformed-prefix handling described.
How can I identify configurations or data that may be affected?
Review entries used to build Net::IP::LPM lookup tables for prefix lengths that are non-numeric, non-ASCII, or integers larger than 31 bits. A single such mask can poison the table and cause lookups to match every address.
What can be done if an immediate update is not possible?
Prevent malformed prefix lengths from reaching the lookup-table builder. Validate that prefix lengths are numeric ASCII values and reject values over 31 bits before adding entries to allow-lists or deny-lists.