Detections
Analytics

Alpine: perl-net-cidr-lite: security update to 0.23-r0

high Tenable Self-Hosted Container Security Plugin ID 440288

Description

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

 - Net::CIDR::Lite versions before 0.23 for Perl does not validate IPv6 group count, which may allow IP ACL
 bypass. _pack_ipv6() does not check that uncompressed IPv6 addresses (without ::) have exactly 8 hex
 groups. Inputs like "abcd", "1:2:3", or "1:2:3:4:5:6:7" are accepted and produce packed values of wrong
 length (3, 7, or 15 bytes instead of 17). The packed values are used internally for mask and comparison
 operations. find() and bin_find() use Perl string comparison (lt/gt) on these values, and comparing
 strings of different lengths gives wrong results. This can cause find() to incorrectly report an address
 as inside or outside a range. Example: my $cidr = Net::CIDR::Lite->new("::/8"); $cidr->find("1:2:3"); #
 invalid input, incorrectly returns true This is the same class of input validation issue as CVE-2021-47154
 (IPv4 leading zeros) previously fixed in this module. See also CVE-2026-40199, a related issue in the same
 function affecting IPv4 mapped IPv6 addresses. (CVE-2026-40198)

 - Net::CIDR::Lite versions before 0.23 for Perl mishandles IPv4 mapped IPv6 addresses, which may allow IP
 ACL bypass. _pack_ipv6() includes the sentinel byte from _pack_ipv4() when building the packed
 representation of IPv4 mapped addresses like ::ffff:192.168.1.1. This produces an 18 byte value instead of
 17 bytes, misaligning the IPv4 part of the address. The wrong length causes incorrect results in mask
 operations (bitwise AND truncates to the shorter operand) and in find() / bin_find() which use Perl string
 comparison (lt/gt). This can cause find() to incorrectly match or miss addresses. Example: my $cidr =
 Net::CIDR::Lite->new("::ffff:192.168.1.0/120"); $cidr->find("::ffff:192.168.2.0"); # incorrectly returns
 true This is triggered by valid RFC 4291 IPv4 mapped addresses (::ffff:x.x.x.x). See also CVE-2026-40198,
 a related issue in the same function affecting malformed IPv6 addresses. (CVE-2026-40199)

Solution

Update the perl-net-cidr-lite library and its related packages to version 0.23-r0 or later.

See Also

https://security.alpinelinux.org/vuln/CVE-2026-40198

https://security.alpinelinux.org/vuln/CVE-2026-40199

Plugin Details

Severity: High

ID: 440288

Version: Revision 1.4

Type: Local

Published: 4/12/2026

Updated: 7/2/2026

Supported Sensors: Agentless Assessment, Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 5

Percentile: 94.27

CVSS v2

Risk Factor: High

Base Score: 7.5

Temporal Score: 5.5

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS Score Source: CVE-2026-40198

CVSS v3

Risk Factor: High

Base Score: 7.5

Temporal Score: 6.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Vulnerability Publication Date: 4/10/2026

Reference Information

CVE: CVE-2026-40198, CVE-2026-40199