CVE-2021-4456

Net::CIDR versions before 0.24 for Perl mishandle leading zeros in IP CIDR addresses, which may have unspecified impact. The functions `addr2cidr` and `cidrlookup` may return leading zeros in a CIDR string, which may in turn be parsed as octal numbers by subsequent users. In some cases an attacker may be able to leverage this to bypass access controls based on IP addresses. The documentation advises validating untrusted CIDR strings with the `cidrvalidate` function. However, this mitigation is optional and not enforced by default. In practice, users may call `addr2cidr` or `cidrlookup` with untrusted input and without validation, incorrectly assuming that this is safe.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://blog.urth.org/2021/03/29/security-issues-in-perl-ip-address-distros/	Third Party Advisory
https://github.com/svarshavchik/Net-CIDR/commit/e3648c6bc6bdd018f90cca4149c467017d42bd10	Patch
https://metacpan.org/dist/Net-CIDR/changes	Release Notes

Configurations

Configuration 1 (hide)

cpe:2.3:a:mrsam:net\:\:cidr:*:*:*:*:*:perl:*:*

History

No history.

Information

Published : 2026-02-27 01:16

Updated : 2026-03-03 20:25

NVD link : CVE-2021-4456

Mitre link : CVE-2021-4456

CVE.ORG link : CVE-2021-4456

JSON object : View

Products Affected

mrsam

net\

CWE

CWE-704

Incorrect Type Conversion or Cast

{"id": "CVE-2021-4456", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 3.9}]}, "published": "2026-02-27T01:16:13.553", "references": [{"url": "https://blog.urth.org/2021/03/29/security-issues-in-perl-ip-address-distros/", "tags": ["Third Party Advisory"], "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}, {"url": "https://github.com/svarshavchik/Net-CIDR/commit/e3648c6bc6bdd018f90cca4149c467017d42bd10", "tags": ["Patch"], "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}, {"url": "https://metacpan.org/dist/Net-CIDR/changes", "tags": ["Release Notes"], "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "description": [{"lang": "en", "value": "CWE-704"}]}], "descriptions": [{"lang": "en", "value": "Net::CIDR versions before 0.24 for Perl mishandle leading zeros in IP CIDR addresses, which may have unspecified impact.\n\nThe functions `addr2cidr` and `cidrlookup` may return leading zeros in a CIDR string, which may in turn be parsed as octal numbers by subsequent users. In some cases an attacker may be able to leverage this to bypass access controls based on IP addresses.\n\nThe documentation advises validating untrusted CIDR strings with the `cidrvalidate` function. However, this mitigation is optional and not enforced by default. In practice, users may call `addr2cidr` or `cidrlookup` with untrusted input and without validation, incorrectly assuming that this is safe."}, {"lang": "es", "value": "Las versiones de Net::CIDR anteriores a la 0.24 para Perl manejan incorrectamente los ceros iniciales en las direcciones IP CIDR, lo que puede tener un impacto no especificado.\n\nLas funciones `addr2cidr` y `cidrlookup` pueden devolver ceros iniciales en una cadena CIDR, que a su vez pueden ser interpretados como n\u00fameros octales por usuarios posteriores. En algunos casos, un atacante podr\u00eda aprovechar esto para eludir los controles de acceso basados en direcciones IP.\n\nLa documentaci\u00f3n aconseja validar cadenas CIDR no confiables con la funci\u00f3n `cidrvalidate`. Sin embargo, esta mitigaci\u00f3n es opcional y no se aplica por defecto. En la pr\u00e1ctica, los usuarios pueden llamar a `addr2cidr` o `cidrlookup` con entrada no confiable y sin validaci\u00f3n, asumiendo incorrectamente que esto es seguro."}], "lastModified": "2026-03-03T20:25:17.910", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:mrsam:net\\:\\:cidr:*:*:*:*:*:perl:*:*", "vulnerable": true, "matchCriteriaId": "DC282B37-1517-408A-A0E6-1A0D5A565B3E", "versionEndExcluding": "0.24"}], "operator": "OR"}]}], "sourceIdentifier": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}