CVE-2026-56015: Net::IP::LPM Buffer Overflow Vulnerability

CVE-2026-56015 Overview

CVE-2026-56015 is a heap out-of-bounds read vulnerability affecting Net::IP::LPM versions through 1.10 for Perl. The module implements Longest Prefix Match (LPM) lookups over IPv4 and IPv6 addresses using an internal trie structure. The flaw allows an attacker who controls prefix input to trigger reads past the end of the 4-byte or 16-byte packed address buffer during trie construction. The issue is classified under [CWE-125] Out-of-bounds Read.

Critical Impact
An attacker-supplied prefix length greater than the address width causes an out-of-bounds heap read during add(), which can crash processes running under a hardened allocator or trigger termination under AddressSanitizer.

Affected Products

Net::IP::LPM Perl module versions through 1.10
Perl applications that pass untrusted prefix input to Net::IP::LPM->add()
Systems using Net::IP::LPM under hardened allocators or memory sanitizers

Discovery Timeline

2026-07-03 - CVE-2026-56015 published to NVD
2026-07-03 - Public discussion on Openwall OSS-Security list
2026-07-06 - Last updated in NVD database

Technical Details for CVE-2026-56015

Vulnerability Analysis

The vulnerability resides in the trie construction path of Net::IP::LPM. When a caller invokes add() with a prefix string, the module passes the prefix directly to the internal addPrefixToTrie() builder without validating the prefix length against the underlying address width. Address widths are fixed at 32 bits for IPv4 and 128 bits for IPv6, backed by 4-byte or 16-byte packed buffers.

addPrefixToTrie() then iterates the prefix buffer bit by bit, reading prefix[byte] for byte values up to prefix_len/8. Supplying a prefix such as add("1.2.3.4/255", $v) or add("2001:db8::/255", $v) drives the loop beyond the packed address boundary and reads adjacent heap memory. Because the prefix length is stored as an unsigned char, the walk reads at most 32 bytes from the start of the buffer.

Root Cause

The root cause is missing input validation on the prefix length parameter before it reaches addPrefixToTrie(). The add() function fails to enforce the prefix_length <= 32 bound for IPv4 or prefix_length <= 128 bound for IPv6. This omission lets a caller-controlled length exceed the packed address size and drive the bit walk into unrelated heap bytes.

Attack Vector

Exploitation requires the ability to supply prefix strings to code that calls Net::IP::LPM->add(). In network-facing services that build LPM tables from untrusted feeds, configuration files, or API input, an attacker can submit a prefix with an oversized length suffix. The out-of-bounds read stays bounded to roughly 32 bytes past the buffer. lookup() and dump() format only the valid address width, so the leaked bytes are not returned through the module's own API. The primary observable impact is process termination under AddressSanitizer, valgrind, or hardened allocators such as scudo and hardened_malloc.

Refer to the MetaCPAN CVE-2026-56015 Patch and the CPAN Ticket #179856 for the corrective code changes.

Detection Methods for CVE-2026-56015

Indicators of Compromise

Unexpected termination of Perl processes that consume Net::IP::LPM with allocator error messages referencing heap-buffer-overflow reads.
AddressSanitizer or valgrind reports pointing to addPrefixToTrie() frames during trie construction.
Log entries containing malformed CIDR strings with prefix lengths above 32 for IPv4 or above 128 for IPv6.

Detection Strategies

Perform static inventory of Perl code to enumerate call sites of Net::IP::LPM->add() and confirm all callers validate prefix length before invocation.
Run affected services against AddressSanitizer or valgrind builds in staging to surface the out-of-bounds read.
Instrument input handlers that accept CIDR strings to log any prefix length that exceeds the address family maximum.

Monitoring Recommendations

Monitor crash telemetry for Perl workers loading Net::IP::LPM and correlate with recent input containing suspicious CIDR values.
Track versions of installed CPAN modules and alert when Net::IP::LPM is at or below 1.10.
Review upstream feeds or API consumers that generate prefix strings for anomalous slash-length values.

How to Mitigate CVE-2026-56015

Immediate Actions Required

Inventory all systems running Perl applications that depend on Net::IP::LPM and identify installed versions.
Upgrade Net::IP::LPM to the patched release that incorporates the fix referenced in the MetaCPAN CVE-2026-56015 Patch.
Add caller-side validation to reject prefix lengths greater than 32 for IPv4 and greater than 128 for IPv6 before invoking add().

Patch Information

The maintainer has published a patch tracked as CVE-2026-56015-r2.patch on MetaCPAN and referenced from CPAN Ticket #179856. The fix validates the prefix length against the address family width prior to invoking addPrefixToTrie(). Details of the coordinated discussion are available on the Openwall OSS-Security Discussion.

Workarounds

Wrap calls to Net::IP::LPM->add() with a guard that parses the CIDR and rejects prefix lengths outside the valid range.
Sanitize any externally sourced prefix strings at the application boundary before they reach the module.
Where upgrade is not immediately possible, restrict inputs to a fixed allow-list of known-good CIDR values.

bash

# Configuration example: upgrade the affected module from CPAN
cpanm Net::IP::LPM~">1.10"

# Verify installed version
perl -MNet::IP::LPM -e 'print $Net::IP::LPM::VERSION, "\n"'