CVE-2026-86287 in Net::IP::LPM
Summary
by MITRE • 09/07/2026
Net::IP::LPM versions before 1.12 for Perl accept malformed prefix lengths.
Non-numeric and non-ASCII prefix lengths are accepted and treated as 0. Integers over 31 bits are silently truncated. A single malformed mask will poison the lookup table.
The result is that the lookup will silently succeed for every address. An allow-list will allow every address, and a deny-list will block every address.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/07/2026
The vulnerability in Net::IP::LPM prior to version 1.12 represents a critical input validation failure within a Perl module designed for longest prefix match IP routing table lookups. The core technical flaw lies in the library's handling of prefix length parameters, which are intended to define the subnet mask width for IPv4 and IPv6 addresses. Instead of strictly enforcing numeric constraints and range limits, the implementation exhibits permissive parsing behavior that accepts malformed inputs without raising exceptions or returning error states. Specifically, non-numeric characters and non-ASCII symbols in the prefix length field are silently coerced into a value of zero. Furthermore, integer values exceeding thirty-one bits for IPv4 contexts are truncated rather than rejected, leading to unintended arithmetic outcomes. This lack of rigorous type checking allows attackers or misconfigured applications to inject invalid data that bypasses standard validation logic entirely.
The operational impact of this flaw is severe due to the mechanism by which lookup tables are constructed and utilized within the module. When a malformed prefix length is processed, it triggers an internal state corruption known as table poisoning. Because non-numeric inputs default to zero and oversized integers result in invalid mask calculations, the resulting lookup entry becomes universally matching for IPv4 addresses. In practical terms, this means that any subsequent IP address query against the poisoned table will return a successful match regardless of whether the queried address actually falls within the intended subnet range. This behavior fundamentally breaks the security assumptions built upon access control lists and routing policies that rely on precise prefix matching to determine authorization or traffic direction.
From an application security perspective, this vulnerability can lead to significant bypasses in network-level filtering mechanisms. If a system utilizes Net::IP::LPM to implement allow-lists for whitelisting trusted IP ranges, the poisoning effect causes the lookup to succeed for every incoming address, effectively granting unrestricted access to all clients and nullifying the whitelist protection. Conversely, if the module is employed within deny-lists or blacklists intended to block malicious traffic, the same flaw results in a universal match that blocks every single address, including legitimate users and internal services. This dual nature of the impact makes it particularly dangerous as it can cause either complete privilege escalation through unauthorized access or severe denial of service by blocking all valid communications depending on the specific configuration context.
This issue aligns with CWE-20 Improper Input Validation, specifically regarding the failure to verify that input data conforms to expected format and range constraints before processing. The silent truncation and coercion behaviors also reflect aspects of CWE-787 Out-of-bounds Write if internal array structures are affected by invalid indices derived from truncated values, although the primary risk is logical rather than memory corruption in this context. In terms of adversarial tactics, an attacker exploiting this flaw to bypass access controls would be engaging in ATT&CK technique T1546 Event Triggered Execution or more broadly T1078 Valid Accounts if used for authentication bypass, while causing a denial of service via resource exhaustion or traffic blocking falls under T1499 Endpoint Denial of Service. The lack of error handling means the system fails to detect anomalous input patterns that would typically trigger security monitoring alerts.
Mitigation strategies must prioritize immediate upgrading to version 1.12 or later, where these validation checks have been corrected to reject malformed prefix lengths explicitly. For systems unable to upgrade immediately, developers should implement strict pre-validation of all IP-related inputs at the application layer before passing them to the Net::IP::LPM module. This includes enforcing regular expressions that restrict input to valid numeric strings and ensuring values fall within the correct bit-length limits for IPv4 (0-32) or IPv6 (0-128). Additionally, integrating runtime monitoring tools that detect unusual patterns in IP address processing can help identify potential exploitation attempts where malformed data is being injected into routing tables. Regular security audits of network filtering logic should also verify that fallback behaviors do not default to permissive states when errors occur, ensuring defense-in-depth principles are maintained even if underlying libraries exhibit vulnerabilities.