Net::CIDR::Set versions prior to 0.23 improperly validate IPv6 prefix lengths in the _encode method, accepting any numeric prefix length without upper bounds. This leads to excessive memory allocation when large prefix lengths are processed, as the mask string and unpacked array sizes scale with the prefix length. The contains() and add() methods can be exploited by passing untrusted input with oversized prefix lengths, causing memory exhaustion and malformed set ranges. Additionally, prefix lengths above 128 result in ranges that do not match the requested block, causing logical inconsistencies in set operations.

An attacker who can supply untrusted input to the contains() or add() methods can cause the process to exhaust available memory, potentially leading to denial of service. Furthermore, malformed set ranges with prefix lengths above 128 can cause incorrect behavior in set membership checks and removals, potentially affecting application logic relying on accurate CIDR set operations.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid passing untrusted or unchecked IPv6 prefix lengths to the contains() or add() methods in Net::CIDR::Set. Implement input validation to restrict prefix lengths to valid ranges (0 to 128) before processing.