CVE-2026-40199
Stigtsp Net\ \
Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:NSummary
CVE-2026-40199 is a medium-severity Improper Handling of Length Parameter Inconsistency (CWE-130) vulnerability in Stigtsp Net\. Its CVSS base score is 6.5 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 23th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SI-2 (Flaw Remediation) and SC-7 (Boundary Protection) — see the control section below for these in your framework.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-21611
Vulnerability Data
Net::CIDR::Lite versions before 0.23 for Perl mishandles IPv4 mapped IPv6 addresses, which may allow IP ACL bypass. _pack_ipv6() includes the sentinel byte from _pack_ipv4() when building the packed representation of IPv4 mapped addresses like ::ffff:192.168.1.1. This produces an 18 byte…
more
value instead of 17 bytes, misaligning the IPv4 part of the address. The wrong length causes incorrect results in mask operations (bitwise AND truncates to the shorter operand) and in find() / bin_find() which use Perl string comparison (lt/gt). This can cause find() to incorrectly match or miss addresses. Example: my $cidr = Net::CIDR::Lite->new("::ffff:192.168.1.0/120"); $cidr->find("::ffff:192.168.2.0"); # incorrectly returns true This is triggered by valid RFC 4291 IPv4 mapped addresses (::ffff:x.x.x.x). See also CVE-2026-40198, a related issue in the same function affecting malformed IPv6 addresses.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Logic error in IPv4-mapped IPv6 handling produces incorrect CIDR matches, enabling direct bypass of IP ACLs in any public-facing service that uses the library for access control.
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
Mitigating Controls (NIST 800-53 r5) AI
Directly requires timely patching or updating of the vulnerable Net::CIDR::Lite library to version 0.23+ that corrects the _pack_ipv6 length error for IPv4-mapped addresses.
Requires validation of IP address inputs to reject or normalize IPv4-mapped IPv6 forms (::ffff:x.x.x.x) before they reach the flawed pack/find routines.
Enforces boundary access control lists using vetted mechanisms rather than the defective Perl module, preventing the ACL bypass condition.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly enforce length validation and input sanitization during coding and review.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing in development can detect length-inconsistency vulnerabilities before deployment.
Secure development lifecycle mandates input validation and length checks that directly address inconsistent length fields.
Application security requirements include explicit rules for handling message lengths and data structures.
Secure architecture principles require robust parsing and bounds checking to prevent length-related flaws.
Secure coding standards directly prohibit improper length handling and enforce defensive parsing practices.