The vulnerability in Net::CIDR::Lite (prior to version 0.24) arises from improper validation of CIDR mask inputs, specifically failing to reject extraneous zero characters in mask values. This allows mask forms like "/00" and "/01" to be accepted and parsed equivalently to their unpadded forms, which can lead to IP Access Control List (ACL) bypass. The issue is tracked as CVE-2026-45191 and classified under CWE-1289 (Improper Validation of Unsafe Equivalence in Input). The CVSS 3.1 base score is 6.5, reflecting a medium severity with network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality impact, limited integrity impact, and limited availability impact.

An attacker could exploit this vulnerability to bypass IP-based access controls by using specially crafted CIDR mask values with extraneous zeros. This could allow unauthorized access or disruption of services protected by IP ACLs relying on Net::CIDR::Lite for mask validation. There is no evidence of confidentiality impact, but integrity and availability impacts are rated as low and low respectively. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider implementing additional validation on CIDR mask inputs to reject extraneous zero characters or avoid relying solely on vulnerable versions of Net::CIDR::Lite for critical IP ACL enforcement.