The vulnerability in Net::CIDR::Lite (pre-0.24) arises from improper validation of IP address and CIDR mask inputs. Specifically, inputs containing trailing newline characters or non-ASCII digit characters are accepted by validators but are then re-encoded to different addresses by the parser. This discrepancy causes the find() and bin_find() methods to return incorrect results, potentially allowing IP access control list (ACL) bypass. For example, adding the CIDR "::1\n/128" and then searching for "::1a" incorrectly returns true. This issue is classified under CWE-1289 (Improper Validation of Unsafe Equivalence in Input). No CVSS score or official remediation information is currently available.

The vulnerability can cause IP ACL bypass due to inconsistent validation and parsing of IP addresses and CIDR masks. This may allow unauthorized access if ACLs rely on Net::CIDR::Lite for IP matching. There are no known exploits in the wild at this time. The lack of proper input validation undermines the reliability of IP-based access controls using this library.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should avoid using vulnerable versions of Net::CIDR::Lite or implement additional input validation to reject inputs containing trailing newlines or non-ASCII digit characters. Monitor official STIGTSP advisories for updates and patches.