Memory Exhaustion Vulnerability in Net::CIDR::Set by Perl

CVE-2026-19566

What is CVE-2026-19566?

Versions of the Net::CIDR::Set module prior to 0.23 for Perl are susceptible to memory exhaustion due to unbounded IPv6 prefix lengths. The vulnerability arises when the _encode method allows any prefix length, building oversized data structures that consume excessive amounts of memory. An attacker can exploit this flaw by passing malicious input to the contains() or add() methods, potentially exhausting the process memory and causing denial of service. Special attention should be given to prefix lengths above 128, as they may lead to incorrect behavior when evaluated against expected ranges.

References