By weakness (CWE)

CWE-1289: related vulnerabilities

CVEs classified under CWE-1289. Understanding the weakness class helps prioritize systemic fixes over one-off patches.

4 published vulnerabilities

• CVE-2026-49942HIGH 7.3

  Net::CIDR::Set, a Perl library for managing CIDR network blocks, contains a validation flaw in versions through 0.20 that allows attackers to bypass network access controls. The vulnerability stems from improper handling of network masks—the library accepts Unicode digit characters (such as Arabic-Indic numerals) and non-digit characters in mask fields, treating them as valid input. Additionally, leading zeros in masks are processed as decimal rather than octal, creating confusion about which networks are actually permitted. Together, these issues can cause the library to accept significantly larger or differently scoped networks than intended, potentially allowing unauthorized traffic or connections that should have been blocked.

• CVE-2026-42462HIGH 7.0

  Fedify, a TypeScript library for building federated applications using ActivityPub, contains a vulnerability that allows attackers to manipulate cryptographically signed activities without invalidating the signatures. By exploiting JSON-LD (JSON Linked Data) restructuring techniques, an attacker who receives a validly signed activity from a third party can alter its meaning and content while the Linked Data Signature remains valid. This breaks the integrity guarantee that signatures are supposed to provide, enabling attackers to forge or modify federated messages in a way that appears authentic.

• CVE-2026-49940MEDIUM 6.5

  Net::CIDR::Set, a Perl library for managing IP address ranges, has a parsing vulnerability in versions up to 0.20. The library incorrectly accepts non-ASCII Unicode digits (such as Arabic-Indic numerals) in IP addresses and network masks. Because these Unicode characters aren't properly converted to their numeric values, network masks may be parsed incorrectly, potentially causing the library to accept a broader range of IP addresses than intended. This could allow an attacker to bypass network access controls or firewall rules that rely on this library for IP validation.

• CVE-2026-47674MEDIUM 5.3

  Hono's IP-restriction middleware, a security component designed to enforce access control by allowing or denying traffic based on IP address rules, contains a flaw in how it compares incoming IP addresses against configured rules. The vulnerability exists because the middleware only performs partial normalization of IPv6 addresses before comparing them to stored rules. When an attacker sends a request using an alternative representation of an IPv6 address—such as compressed notation, explicit-zero forms, or IPv4-mapped hex notation—the middleware fails to recognize it as matching a rule, silently skipping the check. This allows traffic that should be blocked to pass through, or blocks traffic that should be allowed, depending on rule configuration. The flaw affects Hono versions prior to 4.12.21.