Non-numeric and non-ASCII prefix lengths are accepted and treated as 0. Integers over 31 bits are silently truncated. A single malformed mask will poison the lookup table.
The result is that the lookup will silently succeed for every address. An allow-list will allow every address, and a deny-list will block every address.
Analysis
Analysis and contextual insights are available on OpenCVE Cloud.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| unaffected |
|
No data.
No data.
No data available yet.
Vendor Solution
Upgrade to Net::IP::LPM version 1.12 or later.
Tracking
Sign in to view the affected projects.
No advisories yet.
Mon, 07 Sep 2026 18:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Net::IP::LPM versions before 1.12 for Perl accept malformed prefix lengths. Non-numeric and non-ASCII prefix lengths are accepted and treated as 0. Integers over 31 bits are silently truncated. A single malformed mask will poison the lookup table. The result is that the lookup will silently succeed for every address. An allow-list will allow every address, and a deny-list will block every address. | |
| Title | Net::IP::LPM versions before 1.12 for Perl accept malformed prefix lengths | |
| Weaknesses | CWE-1287 | |
| References |
|
Subscriptions
No data.
MITRE
Status: PUBLISHED
Assigner: CPANSec
Published:
Updated: 2026-09-07T18:25:37.140Z
Reserved: 2026-09-06T14:31:43.537Z
Link: CVE-2026-86287
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-09-07T19:17:28.370
Modified: 2026-09-07T19:17:28.370
Link: CVE-2026-86287
Redhat
No data.
OpenCVE Enrichment
No data.