CVE-2026-19566

Name of the Vulnerable Software and Affected Versions Net::CIDR::Set versions prior to 0.23

Description Unbounded IPv6 prefix lengths can lead to memory exhaustion and the creation of malformed set ranges. The encode() method accepts any prefix length matching (0|[1-9][0-9]*) and passes it to width2bits(), which constructs a mask as a string with one character per bit. Subsequently, the inc() method unpacks this mask into a Perl array, meaning the prefix length directly determines the memory allocation size. For example, a prefix length of 100000000 can result in a 100 MB string and a 12.5 million element array.

Because the contains() function builds a set from its argument and guess coder() attempts to use the IPv6 coder before rejecting oversized prefix lengths during mixed address width checks, any caller passing untrusted input to contains() or add() can exhaust process memory. Additionally, prefix lengths exceeding 128 are stored as ranges that do not match the requested block, causing issues where the contains() function returns false for its own base address and removing an entry drops the base address while the set still indicates coverage.

Recommendations Update Net::CIDR::Set to version 0.23 or later. As a temporary mitigation, restrict or validate untrusted input passed to the contains() and add() functions to ensure prefix lengths do not exceed 128.