CVE-2026-40199

CVE-2026-40199 affects Net::CIDR::Lite before 0.23 for Perl. The bug: _pack_ipv6() incorrectly reuses the IPv4 sentinel byte when encoding IPv4-mapped IPv6 addresses (::ffff: x.x.x.x), producing an 18-byte packed value instead of 17. This mislength misaligns the IPv4 part and breaks mask operatio...

CVE-2026-40198

CVE-2026-40198/40199 affect Net::CIDR::Lite for Perl prior to 0.23. The IPv6 handling flaw in _pack_ipv6() allows malformed uncompressed IPv6 addresses and IPv4-mapped IPv6 addresses to produce packed values of incorrect length, causing mask and comparison operations to misbehave. Consequently, f...