PatchTheCVECVE-2026-40199: Net::CIDR::Lite versions before 0.23 for Perl mishandles IPv4 mapped IPv6 addresses, which may allow IP ACL by
CVE-2026-40199 is a medium-severity flaw (CVSS 6.5) affecting net\. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
Net::CIDR::Lite versions before 0.23 for Perl mishandles IPv4 mapped IPv6 addresses, which may allow IP ACL bypass. _pack_ipv6() includes the sentinel byte from _pack_ipv4() when building the packed representation of IPv4 mapped addresses like ::ffff:192.168.1.1. This produces an 18 byte value instead of 17 bytes, misaligning the IPv4 part of the address. The wrong length causes incorrect results in mask operations (bitwise AND truncates to the
Why this priority
- Remotely exploitable, no login, no user action
A fixed release or distro patch exists.
Risk facts
| CVSS score | 6.5 (Medium) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | None |
| User interaction | None |
| EPSS exploit chance | 0.3% (top 77%) |
| CISA exploited list | No |
| Weakness | CWE-130 |
| Published | 2026-04-10 |
| Last modified | 2026-10-26 |
Last updated 2026-10-26 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2026-40199?
net\: upgrade to 0.23. Exact commands for each OS are on this page.
Is CVE-2026-40199 being exploited?
CVE-2026-40199 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2026-40199 affect?
CVE-2026-40199 affects net\. Severity is medium (CVSS 6.5). Net::CIDR::Lite versions before 0.23 for Perl mishandles IPv4 mapped IPv6 addresses, which may allow IP ACL bypass. _pack_ipv6() includes the sentinel byte from _pack_ipv4() when building the packed representation of IPv4 mapped addresses
How urgent is CVE-2026-40199?
Priority 34/100. Remotely exploitable, no login, no user action
Software pages
Related CVEs
- CVE-2026-40198 HIGH 7.5 UPGRADE Net::CIDR::Lite versions before 0.23 for Perl does not validate IPv6 group count, which may allow IP ACL bypas
- CVE-2026-18108 CRITICAL 9.8 UPGRADE Net::SAML2 versions before 0.86 for Perl allow authentication bypass because _verify_encrypted_assertion accep
- CVE-2026-18089 HIGH 7.5 UPGRADE Net::SAML2 versions before 0.86 for Perl allow SAML authentication bypass by verifying responses against the r
- CVE-2026-18092 HIGH 8.1 UPGRADE Net::SAML2 versions before 0.86 for Perl allow SAML authentication bypass via XML signature wrapping because n