The vulnerability in Net::CIDR::Lite (pre-0.23) arises from _pack_ipv6() not verifying that uncompressed IPv6 addresses contain exactly 8 hex groups. Inputs with fewer groups (e.g., "abcd", "1:2:3", "1:2:3:4:5:6:7") are accepted and produce packed values of incorrect length. These malformed packed values are used in string comparisons within find() and bin_find(), which rely on Perl string comparison operators. Because string comparisons of different lengths yield incorrect results, find() may incorrectly report an address as within or outside a specified CIDR range, enabling potential IP ACL bypass. This is a syntactic input validation flaw classified under CWE-1286 and is related to CVE-2026-40199, which affects IPv4 mapped IPv6 addresses in the same function.

The vulnerability allows attackers to bypass IP access control lists by exploiting improper validation of IPv6 address syntax. This can lead to unauthorized access or incorrect filtering decisions in systems relying on Net::CIDR::Lite for IP range checks. The CVSS score of 7.5 (high) reflects the network attack vector, low complexity, no privileges required, no user interaction, and an integrity impact without confidentiality or availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround is currently documented. Users should monitor the vendor's advisories for updates and consider additional validation of IPv6 input addresses outside of Net::CIDR::Lite until a patch is available.