CVE-2026-40198

OVERVIEW CVE-2026-40198 affects Net::CIDR::Lite, a Perl module for handling Classless Inter-Domain Routing (CIDR) notation, in versions prior to 0.23. The vulnerability exists in the _pack_ipv6() function, which fails to validate that uncompressed IPv6 addresses contain exactly 8 hexadecimal groups. This input validation flaw allows malformed IPv6 addresses such as "abcd", "1:2:3", or incomplete hex groups to be processed and packed into incorrect byte lengths, rather than the expected 17 bytes for properly formatted IPv6 addresses. SEVERITY The vulnerability carries a CVSS 3.1 score of 7.5 (HIGH) with a network-based attack vector requiring no authentication, privileges, or user interaction. The primary impact is integrity-focused, potentially enabling IP access control list (ACL) bypasses. Because the module uses Perl string comparison operations on these incorrectly packed values during find() and bin_find() operations, an attacker can supply crafted IPv6 addresses that produce strings of different lengths, leading to incorrect range comparisons and allowing unauthorized IP addresses to be classified as inside or outside protected ranges. EXPLOITATION STATUS There is no current evidence of active exploitation, with CVE-2026-40198 absent from the Known Exploited Vulnerabilities (KEV) catalog and marked as inactive on security hotlists. Exploit code availability has not been reported. The EPSS score of 0.00047 indicates this vulnerability is currently in the lower percentile of exploitation likelihood compared to other CVEs, suggesting limited immediate community attention despite the high CVSS rating.