CVE-2026-45191: Net::CIDR::Lite Auth Bypass Vulnerability

CVE-2026-45191 Overview

CVE-2026-45191 affects the Net::CIDR::Lite Perl module in versions before 0.24. The module fails to reject extraneous zero characters in Classless Inter-Domain Routing (CIDR) mask values during validation. Mask forms such as /00 and /01 pass the input check and parse to the same prefix as their unpadded equivalents. Applications relying on Net::CIDR::Lite for IP access control list (ACL) enforcement can be bypassed when an attacker submits zero-padded mask values that evade equality-based deny rules. The flaw is categorized under CWE-1289, improper validation of syntactic correctness of input. A related issue is tracked as CVE-2026-45190.

Critical Impact
Zero-padded CIDR masks bypass Net::CIDR::Lite validation, enabling IP ACL bypass against any Perl application that uses the module for network-based access control.

Affected Products

Net::CIDR::Lite Perl module versions prior to 0.24
Perl applications consuming Net::CIDR::Lite for CIDR parsing
Systems enforcing IP allow/deny lists via Net::CIDR::Lite

Discovery Timeline

2026-05-10 - CVE-2026-45191 published to the National Vulnerability Database (NVD)
2026-05-12 - Last updated in NVD database

Technical Details for CVE-2026-45191

Vulnerability Analysis

The vulnerability resides in the CIDR mask parsing routine in Lite.pm. The pre-patch regular expression \A[0-9]+\z accepts any non-empty sequence of digits, including leading zeros. Perl's numeric coercion then converts strings such as "00", "01", or "007" to the same integer as their canonical form. As a result, 10.0.0.0/01 and 10.0.0.0/1 produce identical internal prefix representations, but they are distinct strings to any upstream comparison logic.

Applications that maintain deny lists or allow lists using string comparison of CIDR notation will treat the padded variant as a different entry. A request originating from the padded form can therefore reach a downstream check that accepts the parsed range, granting network access the policy intended to forbid.

Root Cause

The input validation pattern does not enforce canonical decimal representation. It allows extraneous leading zeros that subsequent numeric handling silently normalizes, producing semantically equivalent but textually distinct CIDR masks.

Attack Vector

An attacker submits CIDR values containing zero-padded mask bits to any application that relays user-controlled CIDR strings into Net::CIDR::Lite for ACL evaluation. No authentication or user interaction is required when the parsing path is exposed over the network.

text

     my ($ip, $mask) = split "/", shift;
     $self->_init($ip) || confess "Can't determine ip format" unless %$self;
     confess "Bad mask $mask"
-        unless $mask =~ /\A[0-9]+\z/ and $mask <= $self->{NBITS}-8;
+        unless defined $mask
+        and $mask =~ /\A(?:0|[1-9][0-9]*)\z/
+        and $mask <= $self->{NBITS}-8;
     $mask += 8;
     my $start = $self->{PACK}->($ip) & $self->{MASKS}[$mask]
         or confess "Bad ip address: $ip";

Source: GitHub commit 24e2c43. The patch tightens the regular expression to \A(?:0|[1-9][0-9]*)\z, rejecting any decimal string with a leading zero unless the value is exactly 0, and adds a defined check on $mask.

Detection Methods for CVE-2026-45191

Indicators of Compromise

Inbound HTTP, API, or configuration inputs containing CIDR notation with leading zeros in the mask, such as /00, /01, or /024.
Application logs showing successful access from source IPs whose CIDR representation differs textually from ACL entries but resolves to the same range.
Discrepancies between policy-engine log entries and Net::CIDR::Lite parsed prefixes for the same request.

Detection Strategies

Inventory all Perl applications and CPAN dependencies to identify use of Net::CIDR::Lite below version 0.24.
Add static checks to reject any CIDR string where the mask component matches ^0[0-9]+$ before it reaches downstream parsing.
Compare parsed prefix output with the original input string and alert when normalization changes the textual form.

Monitoring Recommendations

Log raw CIDR inputs at the ACL boundary so investigators can replay parsing decisions.
Alert on configuration files or API payloads containing non-canonical CIDR notation.
Monitor web application firewall (WAF) telemetry for query parameters and JSON fields carrying CIDR values with leading zeros.

How to Mitigate CVE-2026-45191

Immediate Actions Required

Upgrade Net::CIDR::Lite to version 0.24 or later across all Perl runtimes and CPAN-managed environments.
Audit application code paths that pass user-supplied CIDR strings into the module and add canonical-form validation.
Rebuild and redeploy container images or packaged applications that bundle the vulnerable module version.

Patch Information

The fix is included in Net-CIDR-Lite-0.24. See the MetaCPAN release changes and the upstream GitHub commit patch. The patch enforces a stricter regular expression that rejects zero-padded mask values and adds a defined guard on the mask argument.

Workarounds

Pre-validate CIDR input with a strict regex such as ^([0-9]+\.){3}[0-9]+/(0|[1-9][0-9]*)$ before invoking Net::CIDR::Lite.
Normalize CIDR strings to canonical form at the ingress layer and reject any input where normalization alters the original value.
Apply ACL decisions on parsed integer prefixes rather than on raw CIDR strings to remove reliance on textual equality.

bash

# Update Net::CIDR::Lite via cpanm to the patched release
cpanm Net::CIDR::Lite@0.24

# Verify the installed version
perl -MNet::CIDR::Lite -e 'print $Net::CIDR::Lite::VERSION, "\n"'