RRWO Net::CIDR::Set up to 0.20 on Perl improper validation of unsafe equivalence in input

Summaryinfo

A vulnerability was found in RRWO Net::CIDR::Set up to 0.20 on Perl. It has been classified as problematic. This affects an unknown function. The manipulation leads to improper validation of unsafe equivalence in input. This vulnerability is uniquely identified as CVE-2026-49940. The attack is possible to be carried out remotely. No exploit exists.

Detailsinfo

A vulnerability was found in RRWO Net::CIDR::Set up to 0.20 on Perl. It has been rated as problematic. This issue affects an unknown code block. The manipulation with an unknown input leads to a improper validation of unsafe equivalence in input vulnerability. Using CWE to declare the problem leads to CWE-1289. The product receives an input value that is used as a resource identifier or other type of reference, but it does not validate or incorrectly validates that the input is equivalent to a potentially-unsafe value. Impacted is integrity. The summary by CVE is:

Net::CIDR::Set versions through 0.20 for Perl accept non-ASCII IP addresses and netmasks. Unicode digits such as the Arabic-Indic One (U+0661) were accepted but not properly parsed as numbers. This could allow network masks to accept larger networks.

It is possible to read the advisory at metacpan.org. The identification of this vulnerability is CVE-2026-49940 since 06/02/2026. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. The technical details are unknown and an exploit is not publicly available. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 06/04/2026).

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-34297). Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• RRWO

Name

• Net::CIDR::Set

Version

• 0.1
• 0.2
• 0.3
• 0.4
• 0.5
• 0.6
• 0.7
• 0.8
• 0.9
• 0.10
• 0.11
• 0.12
• 0.13
• 0.14
• 0.15
• 0.16
• 0.17
• 0.18
• 0.19
• 0.20

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion