Improper Input Validation in Net::IP::LPM Perl Module Lets Bad Masks Poison Lookups
AI analysis
Net::IP::LPM, a Perl module for longest-prefix-match IP lookups in versions before 1.12, improperly validates prefix lengths (CWE-1287): non-numeric and non-ASCII values are accepted and treated as 0, and prefix-length integers over 31 bits are silently truncated. A single malformed prefix length fed to the module — from untrusted input, configuration, or another data source — poisons the shared lookup table so that every subsequent lookup silently succeeds. The practical result is that allow-lists permit every address (a control bypass) and deny-lists block every address (a denial of service), consistent with the CVSS 7.5 (High) score that rates only availability impact. Any Perl application or service using Net::IP::LPM for access-control or routing-style decisions is affected, especially where prefix lengths are not strictly validated before insertion. No public proof-of-concept is known, the flaw is not in CISA KEV, and EPSS places the 30-day exploitation probability at 0.4%, so no exploitation is currently known.
What to do: Upgrade Net::IP::LPM to version 1.12 or later, which properly validates prefix lengths. Audit code that passes prefix lengths from untrusted input, configuration files, or external data into the module and validate each as a clean integer in the valid range before insertion; rebuild or reload lookup tables after upgrading to clear any already-poisoned entries. Until patched, treat allow-list and deny-list decisions built on this module as unreliable wherever a malformed mask could have been inserted.
Affected
| CPAN (Perl) Net::IP::LPM | All versions before 1.12 |
Estimated exposure
nicheunknown; likely low thousands of Perl deployments or fewer — CPAN publishes no active-install counts comparable to plugin marketplaces, so scale is estimated from the module's niche role in specialized Perl IP/network tooling, typically consumed by individual applications rather than mass-market…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
Net::IP::LPM versions before 1.12 for Perl accept malformed prefix lengths. Non-numeric and non-ASCII prefix lengths are accepted and treated as 0. Integers over 31 bits are silently truncated. A single malformed mask will poison the lookup table. The result is that the lookup will silently succeed for every address. An allow-list will allow every address, and a deny-list will block every address.