The vulnerability in Net::CIDR::Set (up to version 0.20) arises from improper validation of network masks. Specifically, the module fails to correctly handle Unicode digits such as Arabic-Indic numerals and non-digit characters in the mask portion, ignoring them instead of rejecting or properly parsing them. This can result in acceptance of network masks that represent larger networks than intended. Furthermore, leading zeros in masks are interpreted as decimal values rather than octal, which can lead to ambiguity and incorrect network mask interpretation. This issue is classified under CWE-1289 (Improper Validation of Unsafe Equivalence in Input).

The improper validation of network masks may allow an attacker or user to specify larger network ranges than intended, potentially bypassing network restrictions or filters that rely on accurate CIDR mask validation. The confusion caused by leading zeros being treated as decimal rather than octal may also lead to misconfiguration or unintended network access. There are no known exploits in the wild reported for this vulnerability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should carefully validate network mask inputs externally before passing them to Net::CIDR::Set or avoid using affected versions if possible.