CVE-2026-40199

{
  "id": "CVE-2026-40199",
  "sourceIdentifier": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
  "published": "2026-04-10T22:16:21.597",
  "lastModified": "2026-10-26T22:10:00.163",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Net::CIDR::Lite versions before 0.23 for Perl mishandles IPv4 mapped IPv6 addresses, which may allow IP ACL bypass.\n\n_pack_ipv6() includes the sentinel byte from _pack_ipv4() when building the packed representation of IPv4 mapped addresses like ::ffff:192.168.1.1. This produces an 18 byte value instead of 17 bytes, misaligning the IPv4 part of the address.\n\nThe wrong length causes incorrect results in mask operations (bitwise AND truncates to the shorter operand) and in find() / bin_find() which use Perl string comparison (lt/gt). This can cause find() to incorrectly match or miss addresses.\n\nExample:\n\n  my $cidr = Net::CIDR::Lite->new(\"::ffff:192.168.1.0/120\");\n  $cidr->find(\"::ffff:192.168.2.0\");  # incorrectly returns true\n\nThis is triggered by valid RFC 4291 IPv4 mapped addresses (::ffff:x.x.x.x).\n\nSee also CVE-2026-40198, a related issue in the same function affecting malformed IPv6 addresses."
    },
    {
      "lang": "es",
      "value": "Las versiones de Net::CIDR::Lite anteriores a la 0.23 para Perl manejan incorrectamente las direcciones IPv6 mapeadas a IPv4, lo que puede permitir la omisión de ACL de IP.\n\n_pack_ipv6() incluye el byte centinela de _pack_ipv4() al construir la representación empaquetada de direcciones mapeadas a IPv4 como ::ffff:192.168.1.1. Esto produce un valor de 18 bytes en lugar de 17 bytes, desalineando la parte IPv4 de la dirección.\n\nLa longitud incorrecta causa resultados incorrectos en las operaciones de máscara (AND bit a bit trunca al operando más corto) y en find() / bin_find() que usan la comparación de cadenas de Perl (lt/gt). Esto puede hacer que find() coincida o omita direcciones incorrectamente.\n\nEjemplo:\n\n  my $cidr = Net::CIDR::Lite -> new(“::ffff:192.168.1.0/120”);\n  $cidr -> find(“::ffff:192.168.2.0”);  # devuelve true incorrectamente\n\nEsto se activa por direcciones IPv4 mapeadas válidas según RFC 4291 (::ffff:x.x.x.x).\n\nVéase también CVE-2026-40198, un problema relacionado en la misma función que afecta a direcciones IPv6 malformadas."
    }
  ],
  "affected": [
    {
      "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
      "affectedData": [
        {
          "vendor": "STIGTSP",
          "product": "Net::CIDR::Lite",
          "defaultStatus": "unaffected",
          "collectionURL": "https://cpan.org/modules",
          "packageName": "Net-CIDR-Lite",
          "programFiles": [
            "Lite.pm"
          ],
          "programRoutines": [
            {
              "name": "Net::CIDR::Lite::_pack_ipv6"
            }
          ],
          "repo": "https://github.com/stigtsp/Net-CIDR-Lite",
          "versions": [
            {
              "version": "0",
              "lessThan": "0.23",
              "versionType": "custom",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
          "baseScore": 6.5,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 2.5
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-04-13T14:35:14.617789Z",
          "id": "CVE-2026-40199",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-130"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:stigtsp:net\\:\\:cidr\\:\\:lite:*:*:*:*:*:perl:*:*",
              "versionEndExcluding": "0.23",
              "matchCriteriaId": "2B8C0BC5-5E3C-4399-9FD6-437BFF65130F"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/stigtsp/Net-CIDR-Lite/commit/b7166b1fa17b3b14b4c795ace5b3fbf71a0bd04a.patch",
      "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
      "tags": [
        "Patch"
      ]
    },
    {
      "url": "https://metacpan.org/release/STIGTSP/Net-CIDR-Lite-0.23/changes",
      "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
      "tags": [
        "Release Notes"
      ]
    },
    {
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-40198",
      "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
      "tags": [
        "Third Party Advisory"
      ]
    }
  ]
}