CVE-2025-40911 Details
Description
Net::CIDR::Set versions 0.10 through 0.13 for Perl does not properly handle leading zero characters in IP CIDR address strings, which could allow attackers to bypass access control that is based on IP addresses. Leading zeros are used to indicate octal numbers, which can confuse users who are intentionally using octal notation, as well as users who believe they are using decimal notation. Net::CIDR::Set used code from Net::CIDR::Lite, which had a similar vulnerability CVE-2021-47154.
A vulnerability exists in Net::CIDR::Set versions 0.10 through 0.13 for Perl, where the module improperly processes leading zeroes in IP CIDR address strings. This flaw can enable attackers to circumvent access controls based on IP addresses. The misinterpretation of leading zeros, which denote octal values, could confuse users intending to use decimal notation. Net::CIDR::Set incorporates code from Net::CIDR::Lite, which is affected by a similar vulnerability (CVE-2021-47154).
Users can upgrade to Net::CIDR::Set version 0.14 or later, which addresses this vulnerability by disallowing IPv4 addresses with leading zeros in the quads.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed May 27, 2025CISA-ADP
Assessed May 28, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://blog.urth.org/2021/03/29/security-issues-in-perl-ip-address-distros/ | CPANSec | |
| https://github.com/robrwo/perl-Net-CIDR-Set/commit/be7d91e8446ad8013b08b4be313d666dab003a8a.patch | CPANSec | Source CodeVendor |
| https://metacpan.org/release/RRWO/Net-CIDR-Set-0.14/changes | CPANSec | Release NotesVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-1287 | Improper Validation of Specified Type of Input | CPANSec |
Affected Products
| Product | Versions |
|---|---|
| RRWO Net::CIDR::Set | All versions |
CPE
Remediation
| |
| Net::CIDR::Lite | All versions |
CPE
Remediation
| |
| Net::Netmask | All versions |
CPE
Remediation
| |
| Net::IPAddress::Util | All versions |
CPE
Remediation
| |
| Data::Validate::IP | All versions |
CPE
Remediation
| |
| Net::CIDR | All versions |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | CPANSec |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 28, 2025 | CVE Modified | CISA-ADP |
| May 27, 2025 | New CVE Received | CPANSec |