CVE-2021-4456

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2021-4456
Net::CIDR versions before 0.24 for Perl mishandle leading zeros in IP CIDR addresses, which may have unspecified impact. The functions `addr2cidr` and `cidrlookup` may return leading zeros in a CIDR string, which may in turn be parsed as octal numbers by subsequent users. In some cases an attacker may be able to leverage this to bypass access controls based on IP addresses. The documentation advises validating untrusted CIDR strings with the `cidrvalidate` function. However, this mitigation is optional and not enforced by default. In practice, users may call `addr2cidr` or `cidrlookup` with untrusted input and without validation, incorrectly assuming that this is safe.

6.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://blog.urth.org/2021/03/29/security-issues-in-perl-ip-address-distros/ Third Party Advisory
https://github.com/svarshavchik/Net-CIDR/commit/e3648c6bc6bdd018f90cca4149c467017d42bd10 Patch
https://metacpan.org/dist/Net-CIDR/changes Release Notes
Configurations

Configuration 1 (hide)

cpe:2.3:a:mrsam:net\:\:cidr:*:*:*:*:*:perl:*:*
History

03 Mar 2026, 20:25

Type Values Removed Values Added
CPE cpe:2.3:a:mrsam:net\:\:cidr:*:*:*:*:*:perl:*:*
First Time Mrsam
Mrsam net\
References () https://blog.urth.org/2021/03/29/security-issues-in-perl-ip-address-distros/ - () https://blog.urth.org/2021/03/29/security-issues-in-perl-ip-address-distros/ - Third Party Advisory
References () https://github.com/svarshavchik/Net-CIDR/commit/e3648c6bc6bdd018f90cca4149c467017d42bd10 - () https://github.com/svarshavchik/Net-CIDR/commit/e3648c6bc6bdd018f90cca4149c467017d42bd10 - Patch
References () https://metacpan.org/dist/Net-CIDR/changes - () https://metacpan.org/dist/Net-CIDR/changes - Release Notes

27 Feb 2026, 17:16

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 6.5

27 Feb 2026, 14:06

Type Values Removed Values Added
Summary
  • (es) Las versiones de Net::CIDR anteriores a la 0.24 para Perl manejan incorrectamente los ceros iniciales en las direcciones IP CIDR, lo que puede tener un impacto no especificado. Las funciones `addr2cidr` y `cidrlookup` pueden devolver ceros iniciales en una cadena CIDR, que a su vez pueden ser interpretados como números octales por usuarios posteriores. En algunos casos, un atacante podría aprovechar esto para eludir los controles de acceso basados en direcciones IP. La documentación aconseja validar cadenas CIDR no confiables con la función `cidrvalidate`. Sin embargo, esta mitigación es opcional y no se aplica por defecto. En la práctica, los usuarios pueden llamar a `addr2cidr` o `cidrlookup` con entrada no confiable y sin validación, asumiendo incorrectamente que esto es seguro.

27 Feb 2026, 01:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-02-27 01:16

Updated : 2026-03-03 20:25

NVD link : CVE-2021-4456

Mitre link : CVE-2021-4456

CVE.ORG link : CVE-2021-4456

JSON object : View

Products Affected

mrsam

  • net\
CWE
CWE-704

Incorrect Type Conversion or Cast