CVE-2026-45190: Net::CIDR::Lite Auth Bypass Vulnerability

CVE-2026-45190 Overview

CVE-2026-45190 is an input validation flaw in the Net::CIDR::Lite Perl module for versions before 0.24. The module fails to properly validate IP address and CIDR mask inputs, allowing IP Access Control List (ACL) bypass. Inputs containing a trailing newline or non-ASCII Unicode digit characters pass the module's validators but are subsequently re-encoded by the parser into a different address than the input string represented. As a result, the find() and bin_find() methods can match or miss addresses incorrectly, undermining ACL decisions built on this module. The weakness is categorized under [CWE-1289: Improper Validation of Unsafe Equivalence in Input].

Critical Impact
Attackers can craft IP strings that bypass allowlist or blocklist checks, gaining unauthorized network access or evading security controls that rely on Net::CIDR::Lite for CIDR matching.

Affected Products

Net::CIDR::Lite for Perl, all versions prior to 0.24
Perl applications and services using Net::CIDR::Lite for IP ACL enforcement
Related advisory: CVE-2026-45191 (companion issue in the same module)

Discovery Timeline

2026-05-10 - CVE-2026-45190 published to the National Vulnerability Database (NVD)
2026-05-12 - Last updated in NVD database

Technical Details for CVE-2026-45190

Vulnerability Analysis

The vulnerability stems from a mismatch between the module's input validator and its parser. The validator accepts IP and mask strings that contain trailing newlines or non-ASCII digit characters such as Unicode digits. The parser then re-encodes those inputs into a canonical numeric form that does not correspond to the literal string supplied by the caller.

This inconsistency means an attacker can submit an IP string that passes a CIDR membership check while actually representing a different host than intended. Lookup methods like find() and bin_find() therefore return incorrect results. Any application using Net::CIDR::Lite to enforce network ACLs, rate limits, or geolocation-based decisions can be tricked into permitting or denying the wrong traffic.

Root Cause

The underlying weakness is the use of a permissive regular expression for validating numeric input. The original mask validator used /^\d+$/, where \d matches Unicode digits and ^/$ anchors permit a trailing newline. The parser, however, expects strict ASCII numeric content with no trailing whitespace, creating an unsafe equivalence between accepted inputs.

Attack Vector

An attacker submits IP or CIDR input containing characters such as \n or non-ASCII digits (e.g., Arabic-Indic or fullwidth digits) through any network-facing component that passes user-controlled values to Net::CIDR::Lite. The attack is network-reachable, requires no authentication, and no user interaction.

text

     my ($ip, $mask) = split "/", shift;
     $self->_init($ip) || confess "Can't determine ip format" unless %$self;
     confess "Bad mask $mask"
-        unless $mask =~ /^\d+$/ and $mask <= $self->{NBITS}-8;
+        unless $mask =~ /\A[0-9]+\z/ and $mask <= $self->{NBITS}-8;
     $mask += 8;
     my $start = $self->{PACK}->($ip) & $self->{MASKS}[$mask]
         or confess "Bad ip address: $ip";

Source: GitHub Commit Patch

The patch replaces ^\d+$ with \A[0-9]+\z. The new pattern restricts matches to ASCII digits only and uses absolute string anchors that reject trailing newlines.

Detection Methods for CVE-2026-45190

Indicators of Compromise

Application logs showing IP inputs that contain newline characters, control bytes, or non-ASCII Unicode codepoints in the digit ranges.
Successful authenticated or privileged requests from source IPs that should have been blocked by upstream CIDR ACLs.
Discrepancies between proxy or load balancer access logs and downstream application allowlist decisions for the same client address.

Detection Strategies

Inventory Perl applications and CPAN dependencies to identify any use of Net::CIDR::Lite below version 0.24.
Add static analysis or dependency scanning rules that flag Net::CIDR::Lite versions earlier than 0.24 in CPAN manifests and cpanfile lockfiles.
Audit code paths that pass untrusted input to add(), find(), or bin_find() and add normalization checks for ASCII-only digits and absence of whitespace.

Monitoring Recommendations

Log raw IP input bytes (hex-encoded) before ACL evaluation so that newline and non-ASCII digit submissions are visible to detection engineering.
Alert on inputs whose pre-validation byte length differs from a strict ASCII numeric reparse of the same value.
Correlate web application firewall (WAF) decisions with backend ACL outcomes to detect bypass attempts that exploit parser inconsistencies.

How to Mitigate CVE-2026-45190

Immediate Actions Required

Upgrade Net::CIDR::Lite to version 0.24 or later across all Perl environments.
Audit any custom validators that wrap Net::CIDR::Lite and ensure they reject trailing whitespace and non-ASCII digit characters before calling module methods.
Re-test ACL behavior with inputs containing \n and Unicode digits to confirm the fix is effective in production code paths.

Patch Information

The fix is committed upstream and shipped in Net-CIDR-Lite-0.24. See the GitHub Commit Patch and the MetaCPAN Release Changes. Operators should also review the related CVE-2026-45191 Record.

Workarounds

Pre-validate all IP and mask inputs with a strict ASCII regular expression such as \A[0-9.:a-fA-F]+\z before passing them to Net::CIDR::Lite.
Strip or reject inputs containing newline, carriage return, or any byte outside the ASCII printable range prior to ACL evaluation.
Enforce CIDR ACLs at a network boundary (firewall, reverse proxy) that does not rely on the vulnerable Perl module until upgrade is complete.

bash

# Upgrade Net::CIDR::Lite to the fixed release
cpanm Net::CIDR::Lite@0.24

# Verify the installed version
perl -MNet::CIDR::Lite -e 'print $Net::CIDR::Lite::VERSION, "\n"'