CVE-2025-40911

Medium

Description

Net::CIDR::Set versions 0.10 through 0.13 for Perl does not properly handle leading zero characters in IP CIDR address strings, which could allow attackers to bypass access control that is based on IP addresses. Leading zeros are used to indicate octal numbers, which can confuse users who are intentionally using octal notation, as well as users who believe they are using decimal notation. Net::CIDR::Set used code from Net::CIDR::Lite, which had a similar vulnerability CVE-2021-47154.

SeverityMedium

CVSS6.5

Exploit probability—

ProductNet::CIDR::Set

PublishedMay 27, 2025

First seenMay 27, 2025

Weakness typeCWE-1287CWE-1287

How to fix

Patches

github.com/robrwo/perl-Net-CIDR-Set/commit/be7d91e8446ad8013b08b4be313d666dab003a8a.patch

Vendor advisories

metacpan.org/release/RRWO/Net-CIDR-Set-0.14/changes

Affected products

Product	Affected versions	Fixed in
RRWO Net::CIDR::Set	0.10 ≤ v ≤ 0.13	—

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.