CVE-2026-49941: Net::CIDR::Set Infinite Recursion Denial of Service

Technical summary

Net::CIDR::Set versions through 0.20 lack proper input validation in the add method's address parsing logic. The _encode method is called to parse input; if an argument does not match expected netmask or network range patterns, it is recursively passed back to _encode as a 32-bit (IPv4) or 128-bit (IPv6) netmask. When the input is not a well-formed IP address, this recursive call chain never terminates, leading to unbounded recursion and stack exhaustion. The vulnerability is rooted in improper input validation (CWE-1287) and infinite recursion (CWE-674).

Business impact

Applications relying on Net::CIDR::Set for IP filtering, access control lists, or network range management could become unresponsive if an attacker provides crafted input. This could disrupt services dependent on the library, affecting availability for legitimate users. Organizations using this library in production environments, particularly in network security tools or firewall rule engines, should prioritize remediation to maintain service continuity.

Affected systems

Net::CIDR::Set versions 0.20 and earlier are affected. Any Perl application that imports and uses this library to parse IP addresses or network ranges is at risk. This includes custom network management tools, security scripts, and any system that accepts external input for IP address validation via this library.

Exploitability

Exploitation is straightforward and requires no authentication or special privileges. An attacker only needs to supply a malformed IP address string to any code path that calls the add method on a Net::CIDR::Set object. Since the attack vector is network-accessible and the complexity is low, this vulnerability presents a practical denial-of-service risk. No exploit code or user interaction is required.

Remediation

Upgrade Net::CIDR::Set to a patched version released after 0.20. Verify the specific patch version number against the vendor's official release notes. As a temporary mitigation, implement strict input validation on IP address arguments before passing them to Net::CIDR::Set, rejecting any input that does not conform to standard IPv4 or IPv6 notation.

Patch guidance

Check the CPAN repository or the vendor's official advisory for the current recommended version of Net::CIDR::Set. Apply the upgrade across all systems and applications that depend on this library. After patching, conduct regression testing to ensure that legitimate IP address and network range operations function correctly. Verify that the patch is compatible with your Perl version and any other dependencies.

Detection guidance

Monitor for process hangs or high CPU usage in applications using Net::CIDR::Set, particularly when handling external or untrusted input. Review application logs for repeated calls to the add method with unusual or malformed arguments. Implement network-level rate limiting to prevent an attacker from triggering multiple denial-of-service events in quick succession. Intrusion detection systems should flag attempts to pass non-standard IP address formats to services known to use this library.

Why prioritize this

With a CVSS score of 7.5 (HIGH) and a network-accessible attack vector requiring no authentication, this vulnerability poses a clear availability risk. Although it does not enable data theft or system compromise, its ease of exploitation and potential to disrupt production services warrants prompt patching. The lack of KEV designation suggests it has not yet been widely exploited in the wild, but the simplicity of the attack makes it a reasonable candidate for near-term exploitation.

Risk score, explained

The CVSS 3.1 score of 7.5 reflects a high-severity denial-of-service vulnerability. The vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H indicates network accessibility, low attack complexity, no required privileges, no user interaction, and high impact on availability. Confidentiality and integrity are unaffected, keeping the score below critical range, but the straightforward exploitation path and unavailability impact justify the HIGH rating.

Frequently asked questions