CVE-2021-4456: 
Linux Debian vulnerability analysis and mitigation

CVE-2021-4456 is a type conversion vulnerability in the Net::CIDR Perl module (versions before 0.24) that causes leading zeros in IP CIDR addresses to be mishandled, potentially enabling IP-based access control bypasses. The functions addr2cidr and cidrlookup may return CIDR strings with leading zeros, which downstream applications may interpret as octal numbers rather than decimal, creating a discrepancy in IP address logic. The vulnerability was originally identified in 2021 (referenced in a March 2021 blog post) but was formally published as a CVE in February 2026. It carries a CVSS v3.1 base score of 6.5 (Medium/High) (Feedly, GitHub Commit).

The root cause is classified as CWE-704 (Incorrect Type Conversion or Cast): the addr2cidr function constructs CIDR strings by joining IP octets without stripping leading zeros, so an input like 010.0.0.1 may produce output such as 010.0.0.0/8. When a downstream application parses this string, languages or libraries that treat numeric strings with leading zeros as octal (e.g., C, some Perl contexts) will interpret 010 as decimal 8 rather than 10, causing the wrong IP range to be evaluated. The fix, applied in commit e3648c6, adds a regex substitution (s/\A0+([0-9])/\1/) to strip leading zeros from each octet before constructing the CIDR string. The documentation recommends using cidrvalidate to sanitize untrusted input, but this is not enforced by default, meaning callers of addr2cidr or cidrlookup with untrusted data may be silently vulnerable (GitHub Commit, Feedly).

The primary impact is a potential bypass of IP address-based access controls in applications that rely on Net::CIDR for IP validation or filtering. An attacker who can supply or influence IP addresses processed by the vulnerable functions could cause the application to incorrectly allow or deny network traffic, potentially gaining unauthorized access to protected resources. Confidentiality and integrity are both affected (CVSS scores C:L, I:L), while availability is not directly impacted. The severity depends heavily on how the application uses the library's output — systems using Net::CIDR as a security gate for network access decisions are most at risk (Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of publication (Feedly). The EPSS score is approximately 0.034%, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires that an attacker be able to supply or influence IP address input to an application using the vulnerable Net::CIDR functions without the cidrvalidate safeguard (Feedly).

1. Identify a target application: Find a Perl application that uses Net::CIDR (version < 0.24) for IP-based access control, specifically calling addr2cidr or cidrlookup with user-supplied or externally influenced IP addresses without first calling cidrvalidate.
2. Craft a leading-zero IP address: Prepare an IP address with a leading zero in one or more octets (e.g., 010.0.0.1 instead of 10.0.0.1). In octal, 010 equals decimal 8, so the address 010.0.0.1 could be misinterpreted as 8.0.0.1.
3. Submit the crafted input: Supply the crafted IP address as input to the vulnerable application (e.g., via an HTTP header, form field, or API parameter that feeds into the Net::CIDR lookup).
4. Trigger octal misinterpretation: The vulnerable addr2cidr or cidrlookup function returns a CIDR string with a leading zero (e.g., 010.0.0.0/8). A downstream parser interprets this as octal, resolving to a different IP range than intended.
5. Bypass access control: The application evaluates the attacker's actual IP against the wrong CIDR range, potentially granting access that should be denied (or vice versa), achieving unauthorized access to protected functionality (GitHub Commit, Feedly).

• Logs: Application logs showing access from IP addresses with leading zeros in one or more octets (e.g., 010.x.x.x, 192.168.008.x) that would not normally appear in standard network traffic.
• Application Behavior: Unexpected authorization grants or denials for IP addresses that should clearly fall inside or outside a defined CIDR range, particularly for addresses in ranges like 8.0.0.0/8 vs. 10.0.0.0/8.
• Code Audit: Presence of Net::CIDR versions prior to 0.24 in Perl application dependencies (cpanfile, Makefile.PL, or installed module metadata), combined with calls to addr2cidr or cidrlookup without preceding cidrvalidate calls.

The primary remediation is to upgrade Net::CIDR to version 0.24 or later, which strips leading zeros from IP octets in the addr2cidr function before constructing CIDR strings (GitHub Commit). As a temporary workaround for applications that cannot be immediately patched, validate all CIDR strings using the cidrvalidate function before passing them to other processing logic — note this requires explicit code changes and is not enforced by default. Administrators should audit all Perl applications using Net::CIDR for IP-based access control and prioritize patching those that process untrusted IP input (Feedly). Linux distribution packages (Fedora, Ubuntu, Debian) have also released updated packages incorporating the fix (Linux Security).

The underlying issue was first publicly documented in a March 2021 blog post by Dave Rolsky analyzing security issues in Perl IP address distributions, which prompted the fix in Net::CIDR (Feedly). The CVE was formally assigned and published in February 2026, several years after the patch was released, which drew some attention from the Linux distribution security community as Fedora, Ubuntu, and Debian issued updated packages. Coverage was largely limited to Linux distribution security advisories and automated vulnerability tracking services, with no significant broader media or researcher commentary.