PatchSiren cyber security CVE debrief
CVE-2026-49940 RRWO CVE debrief
CVE-2026-49940 is a vulnerability in Net::CIDR::Set versions through 0.20 for Perl. The issue allows non-ASCII IP addresses and netmasks to be accepted but not properly parsed as numbers. This could allow network masks to accept larger networks. The vulnerability has a CVSS score of 6.5 and a severity of MEDIUM.
- Vendor
- RRWO
- Product
- Net::CIDR::Set
- CVSS
- MEDIUM 6.5
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-06-04
- Original CVE updated
- 2026-06-08
- Advisory published
- 2026-06-04
- Advisory updated
- 2026-06-08
Who should care
Users of Net::CIDR::Set versions through 0.20 for Perl should be aware of this vulnerability and take steps to mitigate it.
Technical summary
The vulnerability is caused by the acceptance of non-ASCII IP addresses and netmasks, which are not properly parsed as numbers. This could allow network masks to accept larger networks.
Defensive priority
MEDIUM
Recommended defensive actions
- Update to version 0.21 or later of Net::CIDR::Set
- Use ASCII IP addresses and netmasks
Evidence notes
The vulnerability was reported by Rrwo and has been documented in the NVD.
Official resources
-
CVE-2026-49940 CVE record
CVE.org
-
CVE-2026-49940 NVD detail
NVD
-
Source item URL
nvd_modified
-
Mitigation or vendor reference
9b29abf9-4ab0-4765-b253-1875cd9b441e - Release Notes
-
Mitigation or vendor reference
9b29abf9-4ab0-4765-b253-1875cd9b441e - Third Party Advisory, US Government Resource
CVE-2026-49940 was published on 2026-06-04T17:16:33.053Z and modified on 2026-06-08T16:35:43.660Z.