CVE-2026-19566

Net::CIDR::Set for Perl (versions before 0.23) is vulnerable to memory exhaustion and malformed ranges when handling unbounded IPv6 prefix lengths. The encode path accepts any prefix length (0|[1-9][0-9]*) and builds a mask of width+8 bits, causing large allocations (e.g., ::/100000000 can alloca...