CVE-2026-40198: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-40198 is an improper IPv6 input validation vulnerability in the Perl module Net::CIDR::Lite that may allow attackers to bypass IP-based Access Control Lists (ACLs). The flaw exists in versions before 0.23 of the library, maintained by stigtsp on CPAN. It was published on April 10, 2026, with a patch released the same day. The vulnerability carries a CVSS v3.1 base score of 7.5 (High) (GitHub Advisory, Feedly).

The root cause is classified as CWE-1286 (Improper Validation of Syntactic Correctness of Input). The _pack_ipv6() function in Net::CIDR::Lite fails to verify that uncompressed IPv6 addresses (those without the :: shorthand) contain exactly 8 hexadecimal groups. As a result, malformed inputs such as "abcd", "1:2:3", or "1:2:3:4:5:6:7" are accepted and packed into byte strings of incorrect length (e.g., 3, 7, or 15 bytes instead of the expected 17). The find() and bin_find() functions then perform Perl string comparisons (lt/gt) on these malformed packed values; since Perl string comparison of strings with different lengths produces incorrect results, an attacker-supplied invalid IPv6 address can be incorrectly evaluated as falling inside or outside a CIDR range. The fix, introduced in commit 25d65f8, adds a single guard: return unless $empty or @nums == ($ipv4 ? 6 : 8); (GitHub Patch, GitHub Advisory). This is the same class of issue as CVE-2021-47154, which addressed IPv4 leading-zero bypass in the same module.

The primary impact is an integrity bypass of IP-based access controls. An attacker who can supply a crafted, malformed IPv6 address to an application using Net::CIDR::Lite for ACL enforcement could cause find() or bin_find() to incorrectly report the address as within an allowed range, effectively bypassing network-level access restrictions. There is no direct confidentiality or availability impact from the vulnerability itself, but a successful ACL bypass could grant unauthorized access to protected resources or services, potentially enabling further lateral movement depending on the application context (GitHub Advisory, Feedly).

There is no public proof-of-concept exploit code and no evidence of in-the-wild exploitation at this time (Feedly). The vulnerability is remotely exploitable with no authentication or user interaction required, making it straightforward to attempt if an attacker can influence the IPv6 address passed to the library. The EPSS score is approximately 0.033–0.052%, placing it in the 17th percentile for exploitation likelihood within 30 days (GitHub Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and no threat actor attribution has been reported.

1. Identify target application: Locate a Perl-based application or service that uses Net::CIDR::Lite (versions < 0.23) to enforce IP-based access controls (e.g., allowlists or blocklists based on CIDR ranges).
2. Craft a malformed IPv6 address: Prepare an invalid, uncompressed IPv6 address with fewer than 8 hex groups, such as "1:2:3" or "1:2:3:4:5:6:7", that would normally be rejected by a correct parser.
3. Submit the malformed address: Supply the crafted address as the source IP or as an input parameter to the application's access control check — for example, via an HTTP header, API parameter, or connection source address that the application passes to find() or bin_find().
4. Trigger incorrect ACL evaluation: The _pack_ipv6() function accepts the malformed input and produces a packed byte string of incorrect length. The subsequent string comparison in find() yields an incorrect result, causing the function to return true (address is within the allowed range) even though the address is invalid and should be denied.
5. Gain unauthorized access: The application, believing the ACL check passed, grants access to the protected resource or service (GitHub Advisory, GitHub Patch).

• Network: Incoming requests or connections presenting malformed IPv6 addresses (e.g., addresses with fewer than 8 colon-separated hex groups and no :: compression, such as 1:2:3 or abcd) to services that perform IP-based access control.
• Logs: Application or web server logs showing access from syntactically invalid IPv6 addresses that were granted access to restricted endpoints; unexpected successful authentication or authorization events from non-standard IPv6 format strings.
• Application Behavior: Perl application logs indicating find() or bin_find() returning true for addresses that do not conform to standard IPv6 notation; anomalous access patterns to resources that should be restricted by CIDR-based ACLs.

The primary remediation is to upgrade Net::CIDR::Lite to version 0.23 or later, which adds a validation check in _pack_ipv6() to reject uncompressed IPv6 addresses with fewer than 8 hex groups (GitHub Patch, GitHub Advisory). Distribution-specific packages have been updated for Fedora 42, 43, and 44, Amazon Linux 2023, openSUSE/SUSE, Ubuntu (USN-8406-1), and Mageia. As a defense-in-depth measure, applications should independently validate IPv6 address syntax before passing values to Net::CIDR::Lite, ensuring only well-formed addresses reach the library's ACL functions.

The vulnerability was disclosed via the oss-security mailing list and the GitHub Advisory Database shortly after the patch was released (oss-sec, GitHub Advisory). Multiple Linux distributions, including Fedora, Ubuntu, SUSE, Amazon Linux, and Mageia, issued security advisories and updated packages within weeks of disclosure. Community reaction has been measured, with the vulnerability noted as a recurrence of the same input validation class as CVE-2021-47154, highlighting the importance of comprehensive input validation for all address formats in network libraries.