CVE-2026-86287: Net::IP::LPM Prefix Length Vulnerability

CVE-2026-86287 is a prefix length validation vulnerability in Net::IP::LPM for Perl that causes malformed prefixes to poison lookup tables, making allow-lists permit all addresses and deny-lists block everything. This article covers technical details, affected versions, security impact, and mitigation strategies.

CVE-2026-86287 Overview

CVE-2026-86287 affects the Net::IP::LPM Perl module in versions before 1.12. The module implements Longest Prefix Match (LPM) lookups for IP addresses, commonly used in allow-lists and deny-lists. The library accepts malformed prefix lengths without proper validation. Non-numeric and non-ASCII prefix lengths are silently treated as 0, and integers exceeding 31 bits are truncated. A single malformed mask entry poisons the entire lookup table.

Critical Impact
A poisoned lookup table causes every address query to succeed, meaning allow-lists permit all traffic and deny-lists block all traffic, breaking access control logic that depends on the module.

Affected Products

Net::IP::LPM Perl module versions prior to 1.12
Perl applications using Net::IP::LPM for IP-based access control
Downstream services relying on the module for allow-list or deny-list enforcement

Discovery Timeline

2026-09-07 - CVE CVE-2026-86287 published to NVD
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-86287

Vulnerability Analysis

The vulnerability [CWE-1287] stems from improper validation of specified input to a query function. The lpm_add_raw routine in LPM.xs accepts a prefix length parameter without validating its type, range, or format. When callers supply non-numeric strings, non-ASCII values, or integers exceeding 31 bits, the module coerces them into unintended values instead of rejecting the input.

The result is a corrupted lookup table. A single malformed entry poisons subsequent longest-prefix-match queries. Every IP address then matches, regardless of intent. This inverts the security posture of applications relying on the module for network access control.

Root Cause

The function signature in LPM.xs originally declared prefix_len as an int, causing Perl's XS layer to silently convert unexpected values. Non-numeric strings became 0. Integers over 31 bits were truncated by C integer semantics. Neither case produced an error, so callers received no signal that validation had failed.

Attack Vector

The attack vector requires an attacker-influenced prefix length reaching the module. This can occur through configuration files, upstream data sources, or API inputs that feed into lpm_add or lpm_add_raw. Once a single malformed prefix is inserted, all subsequent lookups return a match. An adversary can bypass IP allow-lists or trigger denial of service against deny-list-based filtering.

text

 lpm_add_raw(handle, prefix, prefix_len, value)
 	int handle
 	SV *prefix
-	int prefix_len
+	IV prefix_len
 	SV *value

Source: GitHub Patch Commit

The patch replaces the int type with Perl's IV (integer value) type and adds validation logic to reject malformed prefix lengths.

Detection Methods for CVE-2026-86287

Indicators of Compromise

Access logs showing successful authentication or authorization from IP addresses outside expected ranges when an allow-list is in use.
Sudden broad denial of legitimate traffic in deny-list-based systems, indicating the lookup table returned universal matches.
Application logs containing non-numeric or unusually large prefix length values passed to Net::IP::LPM routines.

Detection Strategies

Inventory Perl applications and CPAN dependencies to identify installations of Net::IP::LPM below version 1.12.
Review configuration inputs feeding prefix lengths into the module and flag any non-integer or out-of-range values.
Audit code paths calling lpm_add and lpm_add_raw to confirm caller-side validation of prefix inputs.

Monitoring Recommendations

Log all additions to LPM lookup tables with the original prefix length values for forensic review.
Alert on access control decisions that deviate from historical baselines, such as sudden 100% match rates.
Correlate authentication events with source IP reputation to detect allow-list bypass attempts.

How to Mitigate CVE-2026-86287

Immediate Actions Required

Upgrade Net::IP::LPM to version 1.12 or later on all systems where the module is installed.
Audit existing lookup table configurations for malformed prefix entries introduced before the patch.
Add caller-side validation to sanitize prefix length inputs before passing them to the module.

Patch Information

The fix is included in Net::IP::LPM version 1.12, released via CPAN. The patch changes the prefix_len parameter type from int to IV and improves validation of prefixes and lengths. See the GitHub Patch Commit and the MetaCPAN Release Changes for full details. The Openwall OSS Security Discussion provides additional context.

Workarounds

Enforce strict input validation on prefix lengths in application code before calling module functions, rejecting any non-numeric or out-of-range values.
Implement defense-in-depth access controls at the network layer so that a compromised LPM table alone cannot grant unauthorized access.
Restrict who can modify configuration sources that feed prefix lengths into the module.

bash

# Upgrade Net::IP::LPM to the patched version via CPAN
cpanm Net::IP::LPM@1.12

# Verify installed version
perl -MNet::IP::LPM -e 'print $Net::IP::LPM::VERSION, "\n"'