Security Vulnerability in Net::IP::LPM Plugin by Perl
CVE-2026-86287
Currently unrated
What is CVE-2026-86287?
The Net::IP::LPM plugin for Perl is susceptible to a vulnerability where it allows malformed prefix lengths in its configuration. Specifically, it accepts non-numeric and non-ASCII prefix lengths, treating them as zero, while integers exceeding 31 bits are truncated without any warning. This behavior can inadvertently poison the lookup table, causing the system to treat all addresses as valid. Consequently, allow-lists become ineffective as they permit any address, while deny-lists fail to block any addresses. This serious oversight poses substantial risks to network security and necessitates immediate attention.