CVE-2025-40911 Net::CIDR::Set versions 0.10 through 0.13 for Perl does not properly consider leading zero characters in IP CIDR address strings, which could allow attackers to bypass access control that is based on IP addresses

🗓️ 27 May 2025 21:17:42Reported by GoogleType

osv

osv🔗 osv.dev👁 7 Views

CVE-2025-40911 allows IP CIDR bypass via leading zeros in Net::CIDR::Set versions 0.10 to 0.13.

Reporter	Title	Published	Views	Family All 19
Circl	CVE-2025-40911	27 May 202521:41	–	circl
CNNVD	MetaCPAN Net::CIDR::Set 安全漏洞	27 May 202500:00	–	cnnvd
CVE	CVE-2025-40911	27 May 202521:17	–	cve
Cvelist	CVE-2025-40911 Net::CIDR::Set versions 0.10 through 0.13 for Perl does not properly consider leading zero characters in IP CIDR address strings, which could allow attackers to bypass access control that is based on IP addresses	27 May 202521:17	–	cvelist
Debian CVE	CVE-2025-40911	27 May 202521:17	–	debiancve
EUVD	EUVD-2025-16304	3 Oct 202520:07	–	euvd
EUVD	EUVD-2026-34297	4 Jun 202616:07	–	euvd
EUVD	EUVD-2026-34299	4 Jun 202616:07	–	euvd
NVD	CVE-2025-40911	27 May 202522:15	–	nvd
OSV	CVE-2026-49940 Net::CIDR::Set versions through 0.20 for Perl accept non-ASCII IP addresses and netmasks	4 Jun 202616:07	–	osv

Source	Link
cpan	www.cpan.org/modules
github	www.github.com/CVEProject/cvelistV5/tree/main/cves/2025/40xxx/CVE-2025-40911.json
metacpan	www.metacpan.org/release/RRWO/Net-CIDR-Set-0.14/changes
nvd	www.nvd.nist.gov/vuln/detail/CVE-2025-40911
github	www.github.com/robrwo/perl-Net-CIDR-Set/commit/be7d91e8446ad8013b08b4be313d666dab003a8a.patch
github	www.github.com/robrwo/perl-Net-CIDR-Set
blog	www.blog.urth.org/2021/03/29/security-issues-in-perl-ip-address-distros/

15 Jul 2026 01:49Current

6Medium risk

Vulners AI Score6

CVSS 3.16.5

EPSS0.00306

cve-2025-40911 cve-2021-47154 net::cidr::set vulnerability ip cidr address bypass access control