CVE-2026-19566: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-19566 is a memory exhaustion vulnerability in the Perl module Net::CIDR::Set (versions before 0.23) caused by improper validation of IPv6 prefix lengths. Attackers can supply arbitrarily large prefix lengths (e.g., ::/100000000) to trigger unbounded memory allocation, potentially OOM-killing the host process. It was published on August 12, 2026, and is classified as an incomplete fix for the related CVE-2026-49942. It carries a CVSS v3.1 base score of 7.5 (High) (GitHub Advisory, Feedly).

The root cause is classified under CWE-789 (Memory Allocation with Excessive Size Value) and CWE-1284 (Improper Validation of Specified Quantity in Input). The _encode method in Net/CIDR/Set/IPv6.pm accepts any prefix length matching the regex (0|[1-9][0-9]*) without enforcing an upper bound of 128, passing it to _width2bits(), which constructs a bitmask string of '1' x ($width + 8) characters — one character per bit. The _inc() method then unpacks this into a Perl array with one scalar per byte, making memory allocation linear in the attacker-controlled integer: ::/100000000 produces a ~100 MB string and a ~12.5 million element array. Critically, the vulnerable parsing occurs on the argument to contains() or add(), not just on pre-configured ranges — _guess_coder() tries the IPv6 coder before the mixed-address-width check can reject it, meaning even an IPv4-only set is vulnerable. Additionally, prefix lengths above 128 are silently stored as malformed ranges that never match their own base address, creating silent denylist bypass conditions (GitHub Advisory, Patch).

Successful exploitation causes process-level memory exhaustion, resulting in the host process being OOM-killed (SIGKILL under memory-limited environments). There is no confidentiality or integrity impact — the vulnerability is purely an availability concern. Applications using Net::CIDR::Set for IP allowlist/denylist enforcement are additionally at risk of silent security bypass: a prefix like 2001:db8::/129 is accepted and stored but never matches any address, rendering denylist entries ineffective without any error (GitHub Advisory, Feedly).

No public exploit code or in-the-wild exploitation has been reported. The NVD SSVC assessment marks exploitation as "none" and the vulnerability as automatable. The EPSS score is approximately 0.157%, indicating a low probability of near-term exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, the attack requires no authentication, no user interaction, and is network-reachable wherever untrusted input is passed to contains() or add() (Feedly, GitHub Advisory).

1. Identify target: Locate a network-accessible application that uses Net::CIDR::Set (versions < 0.23) and passes user-supplied input to contains() or add() — for example, an IP-based access control or rate-limiting service written in Perl.
2. Craft malicious input: Construct an IPv6 CIDR string with an oversized prefix length, such as ::/100000000 or ::/20000000. The larger the integer, the more memory is allocated.
3. Submit the payload: Send the crafted string as input to any endpoint that invokes contains() or add() on the untrusted value. No authentication is required if the endpoint is public.
4. Trigger memory exhaustion: The _encode method passes the prefix length to _width2bits(), which builds a massive bitmask string; _inc() unpacks it into a huge array. The process RSS grows proportionally (::/20000000 grows RSS by ~186.6 MB) until the process is OOM-killed.
5. Achieve denial of service: The target process is terminated by the OS OOM killer (SIGKILL), causing a service outage. Repeated requests can prevent recovery (GitHub Advisory).

• Network: HTTP requests or other protocol inputs containing IPv6 CIDR strings with prefix lengths exceeding 128 (e.g., ::/100000000, ::/20000000) directed at Perl-based services.
• Process: Sudden termination of Perl application processes with exit signal SIGKILL (signal 9), particularly under memory-constrained environments; rapid RSS growth in Perl processes handling IP address input.
• Logs: OOM killer messages in /var/log/kern.log or dmesg referencing the Perl application process (e.g., Out of memory: Kill process <pid> (<perl-app>)); application error logs showing unexpected process restarts.
• File System: No specific file artifacts expected, as this is a runtime memory exhaustion attack with no persistent payload.

Upgrade Net::CIDR::Set to version 0.23 or later, which adds a bounds check (return if $mask > 128) in the _encode method of Net/CIDR/Set/IPv6.pm before any memory allocation occurs (Patch, MetaCPAN). As a workaround prior to patching, applications should validate that any user-supplied CIDR prefix length does not exceed 128 before passing it to contains() or add(). Additionally, enforcing process memory limits (e.g., via ulimit -v or cgroup memory limits) can reduce the blast radius of exploitation.