CVE-2026-49940

CVE-2026-49940: Net::CIDR::Set versions through 0.20 for Perl accept non-ASCII IP addresses and netmasks

Vendor Rrwo
Product Net::CIDR::Set
Weakness CWE-1289
Published June 4, 2026
Last update June 4, 2026

CVSS base score

What the vulnerability does

01Description

Net::CIDR::Set versions through 0.20 for Perl accept non-ASCII IP addresses and netmasks. Unicode digits such as the Arabic-Indic One (U+0661) were accepted but not properly parsed as numbers. This could allow network masks to accept larger networks.

Key dates

02Disclosure timeline

June 4, 2026 CVE published
June 4, 2026 Record updated