The vulnerability in Net::IP::LPM versions prior to 1.12 arises from improper validation of prefix lengths. Non-numeric and non-ASCII prefix lengths are accepted and treated as zero, while integers exceeding 31 bits are truncated silently. A single malformed mask corrupts the lookup table, causing all address lookups to succeed regardless of actual input. This undermines the intended behavior of allow-lists and deny-lists, effectively disabling their filtering capabilities.

The improper validation leads to a poisoned lookup table where all address lookups succeed. This means that security controls relying on allow-lists will inadvertently allow all addresses, and those relying on deny-lists will block all addresses. This can cause significant security policy failures, potentially allowing unauthorized access or denying legitimate access depending on the list type used.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should avoid using malformed prefix lengths and validate inputs externally before passing them to Net::IP::LPM. Monitor vendor channels for updates regarding an official fix.