These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
CVE-2026-86287 debrief based on the supplied source corpus. The IP-LPM library for Perl accepts malformed prefix lengths, which can lead to silent lookup success for every address. Non-numeric and non-ASCII prefix lengths are treated as 0, and integers over 31 bits are silently truncated. This vulnerability allows for potential bypass of allow-list configurations or blockage of all addresses due to deny-l [truncated]
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-16T14:16:54.970Z and has not been modified since then. The vulnerability affects Net::OAuth versions before 0.32 for Perl, allowing memory exhaustion via unbounded caching of failed module loads in smart_require. This issue can be triggered by a remote client choosing both how many entries are creat [truncated]
Net::OAuth::Client versions before 0.32 for Perl are vulnerable to OAuth 1.0 downgrade attacks. This issue arises when the service provider silently downgrades OAuth 1.0a to OAuth 1.0 in get_request_token, potentially leading to OAuth 1.0 session fixation attacks. Organizations and developers using Net::OAuth::Client versions before 0.32 for Perl in their applications should prioritize upgrading to versio [truncated]
The Net::CIDR::Set module for Perl, versions before 0.23, is vulnerable to memory exhaustion and malformed set ranges via unbounded IPv6 prefix lengths. This vulnerability can be exploited by passing untrusted input to the contains() or add() methods, potentially leading to process memory exhaustion. The vulnerability affects developers and administrators using Net::CIDR::Set in Perl applications, especia [truncated]
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-07T19:17:37.923Z and has not been modified since then. The NVD entry is currently Deferred. File::Rotate::Simple Perl module versions before 0.4.0 create the target of dangling symlinks when rotating files. An attacker with symlink creation ability can use this to create an arbitrary file with permi [truncated]
CVE-2026-16766 is a vulnerability in Catalyst::View::Wkhtmltopdf versions before 0.6.1 for Perl. The vulnerability allows shell command injection via PDF render options. Options are passed directly to the wkhtmltopdf command without sanitization. Any web application that passes user-controlled options such as the page_size, orientation or margins without validation allows shell command injection. Version [truncated]
A heap out-of-bounds read vulnerability exists in Net::IP::LPM versions before 1.11 for Perl. The issue arises from the add() function passing the prefix string to addPrefixToTrie() without checking it against the address width. This can lead to an out-of-bounds read during trie construction, which is detectable under AddressSanitizer, valgrind, or a hardened allocator.
CVE-2026-49942 is a HIGH-severity vulnerability in Net::CIDR::Set versions through 0.20 for Perl. The issue arises from the lack of validation for network masks, which could contain Unicode digits or non-digits that are ignored. This oversight could lead to network masks accepting larger networks than intended. Additionally, leading zeros in network masks were accepted but treated as decimal instead of oc [truncated]
CVE-2026-49941 is a HIGH severity vulnerability in Net::CIDR::Set for Perl. Versions through 0.20 did not validate IP addresses, leading to potential denial of service (DoS) attacks. The `add` method called the `_encode` method to parse addresses. If the addresses did not look like netmasks or network ranges, they were assumed to be single IP addresses and passed back to itself as a 32-bit or 128-bit netm [truncated]
CVE-2026-49940 is a vulnerability in Net::CIDR::Set versions through 0.20 for Perl. The issue allows non-ASCII IP addresses and netmasks to be accepted but not properly parsed as numbers. This could allow network masks to accept larger networks. The vulnerability has a CVSS score of 6.5 and a severity of MEDIUM.
Plack::Middleware::Security::Common versions before 0.13.1 for Perl did not block header injections in request paths. The header injection rule was ineffective at blocking header injections in the request paths unless they were double-encoded. The vulnerability was published on 2026-05-28 and modified later the same day. The vendor is identified as RRWO based on Metacpan reference data, though confidence [truncated]
Mojolicious::Plugin::Statsd versions through 0.04 for Perl allowed metric injection via unvalidated metric names and set values. The plugin failed to sanitize newlines, colons, and pipes—characters with special meaning in the StatsD protocol. Untrusted input used to construct metrics could inject additional StatsD commands, leading to metric manipulation or denial-of-service against downstream monitoring [truncated]
CVE-2026-47373 is a timing-attack issue in the Perl Crypt::SaltedHash module affecting versions through 0.09. The problem comes from using Perl's built-in eq comparison, which can expose timing discrepancies that may help an attacker infer information about the underlying hash. The supplied references point to a fix in Crypt::SaltedHash 0.10 and an associated security disclosure on the same day the CVE was published.
Net::Statsd::Lite versions through 0.10.0 for Perl contain a metric injection vulnerability in the `set_add` method. The method fails to sanitize input values for newlines, colons, and pipes—characters with special meaning in the StatsD protocol. When processing untrusted input, an attacker can inject additional StatsD metrics beyond the intended measurement, potentially corrupting monitoring data, exhaus [truncated]
CVE-2026-45180 is a high-severity vulnerability in Catalyst::Plugin::Statsd versions up to 0.10.0 for Perl. The vulnerability may leak session ids if the communication channel to the statsd daemon is not secured. This could allow an attacker to use session ids as authentication tokens. Affected users should be aware of this vulnerability and take steps to secure their systems by verifying and updating Cat [truncated]
CVE-2026-45179 is a vulnerability in Plack::Middleware::Statsd versions before 0.9.0 for Perl. The issue may leak user IP addresses if the communication channel to the statsd daemon is not secured. Since version 0.9.0, the IP address is no longer logged to statsd unless configured, and an HMAC signature of the IP address is logged instead. This vulnerability affects users of Plack::Middleware::Statsd vers [truncated]