CVE-2026-19566

Range taken from the CVE record, check it before committing. make newentry in security/vuxml creates the vid.

  <vuln vid="FIXME (make newentry)">
    <topic>FIXME -- FIXME</topic>
    <affects>
      <package>
	<name>p5-Net-CIDR-Set</name>
	<range><lt>0.23</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Net::CIDR::Set versions before 0.23 for Perl allow memory exhaustion
	and malformed set ranges via unbounded IPv6 prefix lengths.

The
	_encode method accepts any prefix length matching `(0|[1-9][0-9]*)`
	and passes it to _width2bits(), which builds the mask as `'1' x
	($width + 8)`, one character per bit. The _inc() method then unpacks
	the packed mask into a Perl array of one scalar per byte, so the
	prefix length alone sets the allocation size: `::/100000000` builds a
	100 MB string and a 12.5 million element array. The value being tested
	is parsed, not just the configured ranges: contains() builds a set
	from its argument, and _guess_coder() tries the IPv4 coder and then
	the IPv6 coder, so an IPv4-only set expands an oversized IPv6 prefix
	length before the mixed address width check rejects it.

Any caller
	that passes untrusted input to contains() or add() can exhaust process
	memory. A prefix length above 128 is also stored as a range that does
	not match the requested block: 2001:db8::/129 stringifies back
	unchanged, contains() of its own base address returns false, and
	removing it from a set drops the base address while the set still
	prints as covering it.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2026-19566</cvename>
      <url>https://nvd.nist.gov/vuln/detail/CVE-2026-19566</url>
    </references>
    <dates>
      <discovery>2026-08-12</discovery>
      <entry>2026-10-26</entry>
    </dates>
  </vuln>