Security Advisories (1)
CVE-2026-86287 (2026-09-07)

Net::IP::LPM versions before 1.12 for Perl accept malformed prefix lengths. Non-numeric and non-ASCII prefix lengths are accepted and treated as 0. Integers over 31 bits are silently truncated. A single malformed mask will poison the lookup table. The result is that the lookup will silently succeed for every address. An allow-list will allow every address, and a deny-list will block every address.

Changes for version 1.11

  • Fix CVE-2026-56015 by bounding prefix_length
  • Fix CVE-2025-40910 by reverting back to inet_pton
  • updated documentation with new maintainer
  • updated metadata with git repository
  • added Net::Patricia to SEE ALSO

Modules

Perl implementation of Longest Prefix Match algorithm