TI-2025-27305 Aliases CVE-2025-40911 GHSA-p745-hrr6-rg8c

Net::CIDR::Set versions 0.10 through 0.13 for Perl does not properly consider leading…

LOW 29CWE-1287Published 2025-05-27 · Updated 2025-05-28

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: Low · Low · None
Fix status: No fix listed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA.

Summary

Net::CIDR::Set versions 0.10 through 0.13 for Perl does not properly handle leading zero characters in IP CIDR address strings, which could allow attackers to bypass access control that is based on IP addresses. Leading zeros are used to indicate octal numbers, which can confuse users who are intentionally using octal notation, as well as users who believe they are using decimal notation. Net::CIDR::Set used code from Net::CIDR::Lite, which had a similar vulnerability CVE-2021-47154.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00379 32nd percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
RRWO	Net::CIDR::Set	0.10 – 0.13	—	No fix listed	CNA

Net::CIDR::Set VendorRRWO Affected 0.10 – 0.13 Fixed in — No fix listed CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPE	Versions	Role	Vendor
cpe:2.3:a:rrwo:net\::::::::	—	—	RRWO

cpe:2.3:a:rrwo:net\:*:*:*:*:*:*:*:* Versions — — ·RRWO

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2025-40911
2026-10-03 Alias added: GHSA-p745-hrr6-rg8c

References

Patch 1

https://github.com/robrwo/perl-Net-CIDR-Set/commit/be7d91e8446ad8013b08b4be313d666dab003a8a.patch

Other 2

TI-2026-13955 OS command injection in RRWO Catalyst::View::Wkhtmltopdf CVSS 3.1CRITICAL 9.8
TI-2026-14395 Server-side request forgery in RRWO Plack::App::Prerender CVSS 3.1CRITICAL 9.1
TI-2026-34943 Crypt::SaltedHash versions through 0.09 for Perl generate insecure random values for salts CVSS 3.1CRITICAL 9.1
TI-2026-34345 Net::Statsd::Tiny versions before 0.3.8 for Perl allowed metric injections CVSS 3.1HIGH 8.2
TI-2026-15909 Net::CIDR::Set versions before 0.23 for Perl allow memory exhaustion and malformed set… CVSS 3.1HIGH 7.5
TI-2026-36790 Uncontrolled recursion in RRWO Net::CIDR::Set CVSS 3.1HIGH 7.5

See all 19 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences