The functions `addr2cidr` and `cidrlookup` may return leading zeros in a CIDR string, which may in turn be parsed as octal numbers by subsequent users. In some cases an attacker may be able to leverage this to bypass access controls based on IP addresses.
The documentation advises validating untrusted CIDR strings with the `cidrvalidate` function. However, this mitigation is optional and not enforced by default. In practice, users may call `addr2cidr` or `cidrlookup` with untrusted input and without validation, incorrectly assuming that this is safe.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| MRSAM | Net::CIDR | unaffected |
|
No data.
No data.
No data.
Project Subscriptions
No data.
No advisories yet.
Solution
Use the `cidrvalidate` function on untrusted input before passing to the affected functions or upgrade to version 0.24 or later
Workaround
No workaround given by the vendor.
Fri, 27 Feb 2026 01:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Net::CIDR versions before 0.24 for Perl mishandle leading zeros in IP CIDR addresses, which may have unspecified impact. The functions `addr2cidr` and `cidrlookup` may return leading zeros in a CIDR string, which may in turn be parsed as octal numbers by subsequent users. In some cases an attacker may be able to leverage this to bypass access controls based on IP addresses. The documentation advises validating untrusted CIDR strings with the `cidrvalidate` function. However, this mitigation is optional and not enforced by default. In practice, users may call `addr2cidr` or `cidrlookup` with untrusted input and without validation, incorrectly assuming that this is safe. | |
| Title | Net::CIDR versions before 0.24 for Perl mishandle leading zeros in IP CIDR addresses, which may have unspecified impact | |
| Weaknesses | CWE-704 | |
| References |
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: CPANSec
Published:
Updated: 2026-02-27T00:16:36.383Z
Reserved: 2025-05-18T22:36:11.463Z
Link: CVE-2021-4456
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-02-27T01:16:13.553
Modified: 2026-02-27T01:16:13.553
Link: CVE-2021-4456
Redhat
No data.
OpenCVE Enrichment
No data.