CVE-2026-49941
High
Description
Net::CIDR::Set versions through 0.20 for Perl did not validate IP addresses. The add method called the _encode method to parse addresses. If the addresses did not look like netmasks or network ranges, then they were assumed to single IP addresses and passed back to itself as a 32-bit or 128-bit netmask. If the argument was not a well-formed IP address, then this would lead to indefinite recursion. An attacker could use this to cause a denial of service.
SeverityHigh
CVSS7.5
Exploit probability—
ProductRrwo Net\
PublishedJun 4, 2026
First seenJun 4, 2026
Weakness typeCWE-1287CWE-1287CWE-674CWE-674
How to fix
Update
- rrwo net\0.21 or later
Vendor advisories
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| rrwo net\ | \ ≤ v < 0.21 | 0.21 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.