CVE and update status of the FreeBSD ports tree3,295 unaddressed CVEs in 670 portsAll times are CET
CVE details

CVE-2025-40911

Net::CIDR::Set versions 0.10 through 0.13 for Perl does not properly handle leading zero characters in IP CIDR address strings, which could allow attackers to bypass access control that is based on IP addresses. Leading zeros are used to indicate octal numbers, which can confuse users who are intentionally using octal notation, as well as users who believe they are using decimal notation. Net::CIDR::Set used code from Net::CIDR::Lite, which had a similar vulnerability CVE-2021-47154.

Score
6.5 medium
Published
2025-05-27
Links
NVD · cve.org · Report wrong data

Matched ports (1)

PortPackageVersionStatusMaintainer
net/p5-Net-CIDR-Setp5-Net-CIDR-Set0.13_1unaddressedanes@anes.su

Template for a VuXML entry

Range taken from the CVE record, check it before committing. make newentry in security/vuxml creates the vid.

  <vuln vid="FIXME (make newentry)">
    <topic>FIXME -- FIXME</topic>
    <affects>
      <package>
	<name>p5-Net-CIDR-Set</name>
	<range><lt>FIXME</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Net::CIDR::Set versions 0.10 through 0.13 for Perl does not properly
	handle leading zero characters in IP CIDR address strings, which could
	allow attackers to bypass access control that is based on IP
	addresses.

Leading zeros are used to indicate octal numbers, which
	can confuse users who are intentionally using octal notation, as well
	as users who believe they are using decimal notation.

Net::CIDR::Set
	used code from Net::CIDR::Lite, which had a similar vulnerability
	CVE-2021-47154.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2025-40911</cvename>
      <url>https://nvd.nist.gov/vuln/detail/CVE-2025-40911</url>
    </references>
    <dates>
      <discovery>2025-05-27</discovery>
      <entry>2026-10-26</entry>
    </dates>
  </vuln>