The vulnerability in Net::CIDR::Lite (pre-0.24) arises from improper validation of IP address and CIDR mask inputs. Specifically, inputs containing trailing newline characters or non-ASCII digits bypass the validator but are then re-encoded to different addresses internally. This discrepancy causes the find() and bin_find() functions to return incorrect results, potentially allowing IP ACL bypass. The issue is tracked as CWE-1289 (Improper Validation of Unsafe Equivalence in Input) and has a CVSS 3.1 base score of 6.5, indicating a medium severity level.

An attacker can craft IP address inputs that appear valid to the validator but are interpreted differently by the parser, leading to incorrect access control list (ACL) enforcement. This may allow unauthorized access by bypassing IP-based restrictions. There is no indication of confidentiality loss, but integrity and availability impacts are possible due to ACL bypass. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should avoid relying solely on Net::CIDR::Lite versions before 0.24 for IP ACL enforcement or implement additional input validation to reject inputs with trailing newlines or non-ASCII digit characters.