CVE-2026-86287: CWE-1287 Improper Validation of Specified Type of Input

The vulnerability in Net::IP::LPM versions prior to 1.12 arises from improper validation of prefix length inputs. Non-numeric and non-ASCII prefix lengths are accepted and treated as zero, while integers larger than 31 bits are truncated silently. This malformed input corrupts the lookup table, causing all address lookups to succeed regardless of the intended filtering rules. This undermines the effectiveness of allow-lists and deny-lists, potentially allowing unauthorized access or blocking legitimate traffic.

The vulnerability causes the lookup mechanism to always succeed, effectively disabling the intended access controls. Allow-lists will allow all addresses, negating their purpose, and deny-lists will block all addresses, potentially causing denial of service. There is no direct confidentiality or integrity impact reported, but availability is severely affected.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should avoid using affected versions or implement additional validation controls outside of Net::IP::LPM to ensure prefix lengths are properly validated.