PatchTheCVECVE-2021-4456: Net::CIDR versions before 0.24 for Perl mishandle leading zeros in IP CIDR addresses, which may have unspecifi
CVE-2021-4456 is a medium-severity flaw (CVSS 6.5) affecting net\. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
Net::CIDR versions before 0.24 for Perl mishandle leading zeros in IP CIDR addresses, which may have unspecified impact. The functions `addr2cidr` and `cidrlookup` may return leading zeros in a CIDR string, which may in turn be parsed as octal numbers by subsequent users. In some cases an attacker may be able to leverage this to bypass access controls based on IP addresses. The documentation advises validating untrusted CIDR strings with the `c
Why this priority
- Remotely exploitable, no login, no user action
A fixed release or distro patch exists.
Risk facts
| CVSS score | 6.5 (Medium) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | None |
| User interaction | None |
| EPSS exploit chance | 0.4% (top 69%) |
| CISA exploited list | No |
| Weakness | CWE-704 |
| Published | 2026-02-27 |
| Last modified | 2026-06-17 |
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2021-4456?
net\: upgrade to 0.24. Exact commands for each OS are on this page.
Is CVE-2021-4456 being exploited?
CVE-2021-4456 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2021-4456 affect?
CVE-2021-4456 affects net\. Severity is medium (CVSS 6.5). Net::CIDR versions before 0.24 for Perl mishandle leading zeros in IP CIDR addresses, which may have unspecified impact. The functions `addr2cidr` and `cidrlookup` may return leading zeros in a CIDR string, which may in turn be parsed as o
How urgent is CVE-2021-4456?
Priority 36/100. Remotely exploitable, no login, no user action
Software pages
Related CVEs
- CVE-2026-40199 MEDIUM 6.5 UPGRADE Net::CIDR::Lite versions before 0.23 for Perl mishandles IPv4 mapped IPv6 addresses, which may allow IP ACL by
- CVE-2026-40198 HIGH 7.5 UPGRADE Net::CIDR::Lite versions before 0.23 for Perl does not validate IPv6 group count, which may allow IP ACL bypas
- CVE-2026-18108 CRITICAL 9.8 UPGRADE Net::SAML2 versions before 0.86 for Perl allow authentication bypass because _verify_encrypted_assertion accep
- CVE-2026-18089 HIGH 7.5 UPGRADE Net::SAML2 versions before 0.86 for Perl allow SAML authentication bypass by verifying responses against the r
- CVE-2026-18092 HIGH 8.1 UPGRADE Net::SAML2 versions before 0.86 for Perl allow SAML authentication bypass via XML signature wrapping because n