CVE-2026-19566
Net::CIDR::Set versions before 0.23 for Perl allow memory exhaustion and malformed set ranges via unbounded IPv6 prefix lengths
Description
Net::CIDR::Set versions before 0.23 for Perl allow memory exhaustion and malformed set ranges via unbounded IPv6 prefix lengths. The _encode method accepts any prefix length matching `(0|[1-9][0-9]*)` and passes it to _width2bits(), which builds the mask as `'1' x ($width + 8)`, one character per bit. The _inc() method then unpacks the packed mask into a Perl array of one scalar per byte, so the prefix length alone sets the allocation size: `::/100000000` builds a 100 MB string and a 12.5 million element array. The value being tested is parsed, not just the configured ranges: contains() builds a set from its argument, and _guess_coder() tries the IPv4 coder and then the IPv6 coder, so an IPv4-only set expands an oversized IPv6 prefix length before the mixed address width check rejects it. Any caller that passes untrusted input to contains() or add() can exhaust process memory. A prefix length above 128 is also stored as a range that does not match the requested block: 2001:db8::/129 stringifies back unchanged, contains() of its own base address returns false, and removing it from a set drops the base address while the set still prints as covering it.
INFO
Published Date :
Aug. 12, 2026, 9:17 a.m.
Last Modified :
Oct. 23, 2026, 8:10 p.m.
Remotely Exploit :
Yes !
Source :
9b29abf9-4ab0-4765-b253-1875cd9b441e
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | |||||
| CVSS 3.1 | HIGH | 134c704f-9b21-4f2e-91b3-4a467353bcc0 |
Solution
- Update Net::CIDR::Set to version 0.23 or later.
- Validate all input for prefix lengths.
- Avoid using untrusted input in contains() or add().
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-19566.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-19566 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-19566
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-19566 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-19566 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Translated by [email protected]
Oct. 23, 2026
Action Type Old Value New Value Added Translation Title: Net::CIDR::Set de RRWO, Description: Versiones de Net::CIDR::Set anteriores a la 0.23 para Perl permiten el agotamiento de la memoria y rangos de conjunto mal formados a través de longitudes de prefijo IPv6 ilimitadas. El método _encode acepta cualquier longitud de prefijo que coincida con “(0|[1-9][0-9]*)” y la pasa a _width2bits(), que construye la máscara como “’1’ x ($width + 8)”, un carácter por bit. El método _inc() luego desempaqueta la máscara empaquetada en un array de Perl de un escalar por byte, por lo que la longitud del prefijo por sí sola establece el tamaño de asignación: “::/100000000” construye una cadena de 100 MB y un array de 12.5 millones de elementos. El valor que se está probando se analiza, no solo los rangos configurados: contains() construye un conjunto a partir de su argumento, y _guess_coder() prueba el codificador IPv4 y luego el codificador IPv6, por lo que un conjunto solo IPv4 expande una longitud de prefijo IPv6 sobredimensionada antes de que la verificación de ancho de dirección mixta lo rechace. Cualquier llamador que pase entrada no confiable a contains() o add() puede agotar la memoria del proceso. Una longitud de prefijo superior a 128 también se almacena como un rango que no coincide con el bloque solicitado: 2001:db8::/129 se convierte a cadena sin cambios, contains() de su propia dirección base devuelve falso, y al eliminarlo de un conjunto se elimina la dirección base mientras que el conjunto aún se imprime como si lo cubriera. -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Aug. 12, 2026
Action Type Old Value New Value Added CVSS V3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Added SSVC {'id': 'CVE-2026-19566', 'role': 'CISA Coordinator', 'options': [{'exploitation': 'none'}, {'automatable': 'yes'}, {'technicalImpact': 'partial'}], 'version': '2.0.3', 'timestamp': '2026-08-12T19:49:22.654200Z'} -
New CVE Received by 9b29abf9-4ab0-4765-b253-1875cd9b441e
Aug. 12, 2026
Action Type Old Value New Value Added Affected [{'repo': 'https://github.com/robrwo/perl-Net-CIDR-Set', 'vendor': 'RRWO', 'product': 'Net::CIDR::Set', 'versions': [{'status': 'affected', 'version': '0', 'lessThan': '0.23', 'versionType': 'custom'}], 'packageName': 'Net-CIDR-Set', 'programFiles': ['lib/Net/CIDR/Set/IPv6.pm', 'lib/Net/CIDR/Set.pm'], 'collectionURL': 'https://cpan.org/modules', 'defaultStatus': 'unaffected', 'programRoutines': [{'name': 'Net::CIDR::Set::IPv6::_encode'}, {'name': 'Net::CIDR::Set::IPv6::_width2bits'}]}] Added Description Net::CIDR::Set versions before 0.23 for Perl allow memory exhaustion and malformed set ranges via unbounded IPv6 prefix lengths. The _encode method accepts any prefix length matching `(0|[1-9][0-9]*)` and passes it to _width2bits(), which builds the mask as `'1' x ($width + 8)`, one character per bit. The _inc() method then unpacks the packed mask into a Perl array of one scalar per byte, so the prefix length alone sets the allocation size: `::/100000000` builds a 100 MB string and a 12.5 million element array. The value being tested is parsed, not just the configured ranges: contains() builds a set from its argument, and _guess_coder() tries the IPv4 coder and then the IPv6 coder, so an IPv4-only set expands an oversized IPv6 prefix length before the mixed address width check rejects it. Any caller that passes untrusted input to contains() or add() can exhaust process memory. A prefix length above 128 is also stored as a range that does not match the requested block: 2001:db8::/129 stringifies back unchanged, contains() of its own base address returns false, and removing it from a set drops the base address while the set still prints as covering it. Added CWE CWE-789 Added CWE CWE-1284 Added Reference https://github.com/robrwo/perl-Net-CIDR-Set/commit/e16b27db676fd1ca671fbb31208a22c1b1ba9724.patch Added Reference https://github.com/robrwo/perl-Net-CIDR-Set/security/advisories/GHSA-grjr-r4x5-mx4p Added Reference https://metacpan.org/release/RRWO/Net-CIDR-Set-0.23/changes Added Reference https://www.cve.org/CVERecord?id=CVE-2026-49942