CVE-2026-40198
Stigtsp Net\ \
Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:NCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2026-40198 is a high-severity Improper Validation of Syntactic Correctness of Input (CWE-1286) vulnerability in Stigtsp Net\. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 23th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SI-10 (Information Input Validation) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2026-40198 is an input validation flaw in Net::CIDR::Lite, a Perl module for handling CIDR IP address ranges, affecting versions prior to 0.23. The vulnerability resides in the _pack_ipv6() function, which fails to verify that uncompressed IPv6 addresses (lacking :: abbreviation) contain exactly eight hexadecimal groups. Malformed inputs such as "abcd", "1:2:3", or "1:2:3:4:5:6:7" are accepted, resulting in incorrectly packed binary values of improper lengths (e.g., 3, 7, or 15 bytes instead of the expected 17 bytes). These erroneous packed values propagate to mask and comparison operations in find() and bin_find(), where Perl's string comparison (lt/gt) on unequal-length strings produces incorrect inclusion/exclusion results for IP ranges.
Remote attackers without authentication can exploit this issue by supplying crafted IPv6 addresses to applications using Net::CIDR::Lite for IP access control lists (ACLs) or range checks. For instance, an input like "1:2:3" may be falsely reported as matching a broad range such as "::/8", enabling unauthorized access. The CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) reflects high integrity impact through ACL bypass, with no confidentiality or availability disruption. This mirrors a prior issue, CVE-2021-47154, involving IPv4 leading zeros, and relates to CVE-2026-40199 affecting IPv4-mapped IPv6 addresses in the same function.
Mitigation requires upgrading to Net::CIDR::Lite version 0.23, which addresses the flaw via validation enhancements in _pack_ipv6(), as detailed in the module's changes on MetaCPAN and a corresponding GitHub commit (25d65f85dbe4885959a10471725ec9d250a589c3). Practitioners should audit dependencies using this module in network filtering or firewall scripts and apply the patch promptly, associating the issue with CWE-1286 (Improper Validation of Array Index).
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-21609
Vulnerability Data
Net::CIDR::Lite versions before 0.23 for Perl does not validate IPv6 group count, which may allow IP ACL bypass. _pack_ipv6() does not check that uncompressed IPv6 addresses (without ::) have exactly 8 hex groups. Inputs like "abcd", "1:2:3", or "1:2:3:4:5:6:7" are…
more
accepted and produce packed values of wrong length (3, 7, or 15 bytes instead of 17). The packed values are used internally for mask and comparison operations. find() and bin_find() use Perl string comparison (lt/gt) on these values, and comparing strings of different lengths gives wrong results. This can cause find() to incorrectly report an address as inside or outside a range. Example: my $cidr = Net::CIDR::Lite->new("::/8"); $cidr->find("1:2:3"); # invalid input, incorrectly returns true This is the same class of input validation issue as CVE-2021-47154 (IPv4 leading zeros) previously fixed in this module. See also CVE-2026-40199, a related issue in the same function affecting IPv4 mapped IPv6 addresses.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V1.1.1V1.4.2V2.1.1V2.2.2
Mitigating Controls (NIST 800-53 r5) AI
SI-10 requires validation of information inputs for correctness, directly stopping syntactic validation failures from being introduced or exploitable.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly require syntactic input validation to prevent malformed data handling.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing in development catches missing or incorrect syntax validation.
Secure development life cycle mandates input validation to ensure syntactic correctness.
Application security requirements explicitly call for validation of input syntax.
Secure architecture principles reduce the likelihood of missing syntactic checks.
Secure coding standards directly require proper syntactic validation of all inputs.