The vulnerability in Net::CIDR::Lite prior to version 0.23 arises from improper validation of the syntactic correctness of uncompressed IPv6 addresses. The _pack_ipv6() function does not verify that uncompressed IPv6 addresses contain exactly 8 hex groups, allowing inputs like "abcd", "1:2:3", or "1:2:3:4:5:6:7" to be accepted. These inputs produce packed byte strings of incorrect length, which are then used in mask and comparison operations. The find() and bin_find() functions rely on Perl string comparison on these packed values, and comparing strings of different lengths yields incorrect results. This can cause the find() method to mistakenly report an invalid IPv6 address as being within a CIDR range, effectively enabling IP ACL bypass. This issue is related to a previously fixed input validation problem (CVE-2021-47154) and is linked to CVE-2026-40199 affecting IPv4 mapped IPv6 addresses.

The impact of this vulnerability is that IP address access control lists (ACLs) relying on Net::CIDR::Lite may be bypassed due to incorrect validation and comparison of IPv6 addresses. This could allow unauthorized IP addresses to be treated as authorized within network filtering or access control contexts. There is no evidence of known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. There is no official fix or patch information available at this time. Users should monitor the vendor's communications for updates and consider implementing additional input validation controls externally to mitigate risk until a patch is released.