RRWO Net::CIDR::Set up to 0.20 on Perl improper validation of unsafe equivalence in input

Summaryinfo

A vulnerability was found in RRWO Net::CIDR::Set up to 0.20 on Perl. It has been rated as problematic. Affected is an unknown function. This manipulation causes improper validation of unsafe equivalence in input. The identification of this vulnerability is CVE-2026-49942. It is possible to initiate the attack remotely. There is no exploit available.

Detailsinfo

A vulnerability classified as problematic was found in RRWO Net::CIDR::Set up to 0.20 on Perl. Affected by this vulnerability is an unknown function. The manipulation with an unknown input leads to a improper validation of unsafe equivalence in input vulnerability. The CWE definition for the vulnerability is CWE-1289. The product receives an input value that is used as a resource identifier or other type of reference, but it does not validate or incorrectly validates that the input is equivalent to a potentially-unsafe value. As an impact it is known to affect integrity. The summary by CVE is:

Net::CIDR::Set versions through 0.20 for Perl did not validate network masks. The mask portion of a network mask could contain Unicode digits such as the Arabic-Indic One (U+0661), or non-digits, which were ignored. This could allow network masks to accept larger networks. Leading zeros were also accepted, but treated as decimal instead of octal. This could lead to confusion about what networks are acceptable.

The advisory is shared at metacpan.org. This vulnerability is known as CVE-2026-49942 since 06/02/2026. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. Neither technical details nor an exploit are publicly available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 06/04/2026).

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Vendor

• RRWO

Name

• Net::CIDR::Set

Version

• 0.1
• 0.2
• 0.3
• 0.4
• 0.5
• 0.6
• 0.7
• 0.8
• 0.9
• 0.10
• 0.11
• 0.12
• 0.13
• 0.14
• 0.15
• 0.16
• 0.17
• 0.18
• 0.19
• 0.20

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion