CVE-2026-40198 STIGTSP CVE debrief

Who should care

Defenders responsible for Perl applications using Net::CIDR::Lite, particularly those with IP ACL configurations, should assess exposure and prioritize updates. They should review IP ACL configurations for potential bypasses and verify that all affected systems are updated and patched. Additionally, they should consider implementing additional security measures to detect and prevent potential attacks.

Why it matters

Defenders should prioritize verifying and updating Net::CIDR::Lite to version 0.23 or later, and review IP ACL configurations for potential bypasses due to incorrect IPv6 address validation.

• Potential IP ACL bypasses due to incorrect validation of IPv6 addresses
• Incorrect results in IP ACL operations
• Possible security risks due to processing of malicious inputs

Technical summary

Net::CIDR::Lite versions before 0.23 for Perl do not validate IPv6 group counts, allowing potentially malicious inputs to be processed. This can cause incorrect results in IP ACL operations, potentially leading to IP ACL bypasses. The issue arises from the _pack_ipv6() function not checking that uncompressed IPv6 addresses have exactly 8 hex groups, leading to incorrect packed values. Defenders should prioritize verifying and updating Net::CIDR::Lite to version 0.23 or later and review IP ACL configurations for potential bypasses.

Defensive priority

Defenders should prioritize verifying and updating Net::CIDR::Lite to version 0.23 or later, and review IP ACL configurations for potential bypasses.

Recommended defensive actions

• Verify and update Net::CIDR::Lite to version 0.23 or later
• Review IP ACL configurations for potential bypasses
• Monitor for suspicious IP ACL activity
• Perform a thorough review of the IP ACL configurations to ensure they are not vulnerable to bypasses
• Consider implementing additional security measures to detect and prevent potential attacks
• Verify that all affected systems are updated and patched
• Conduct regular security audits to identify potential vulnerabilities

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including a description of the issue and affected versions. The vulnerability is caused by a lack of validation in the _pack_ipv6() function, which can lead to incorrect results in IP ACL operations. Defenders should verify and update Net::CIDR::Lite to version 0.23 or later and review IP ACL configurations for potential bypasses.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.