CPAN

Related CVEsby mentions

• CVE-2026-862877.5<1%
  Improper Input Validation in Net::IP::LPM Perl Module Lets Bad Masks Poison Lookups
  Net::IP::LPM, a Perl module for longest-prefix-match IP lookups in versions before 1.12, improperly validates prefix lengths (CWE-1287): non-numeric and non-ASCII values are accepted and treated as 0, and prefix-length integers over 31 bits are silently truncated. A single malformed prefix length fed to the module — from untrusted input, configuration, or another data source — poisons the shared lookup table so that every subsequent lookup silently succeeds. The practical result is that allow-lists permit every address (a control bypass) and deny-lists block every address (a denial of service), consistent with the CVSS 7.5 (High) score that rates only availability impact. Any Perl application or service using Net::IP::LPM for access-control or routing-style decisions is affected, especially where prefix lengths are not strictly validated before insertion. No public proof-of-concept is known, the flaw is not in CISA KEV, and EPSS places the 30-day exploitation probability at 0.4%, so no exploitation is currently known.
  · CPAN (Perl) Net::IP::LPM All versions before 1.12niche
• CVE-2026-160287.5<1%
  Memory exhaustion DoS in Protocol::HTTP2 Perl module before 1.14
  Protocol::HTTP2 versions before 1.14 for Perl never removes CLOSED streams from the per-connection stream table: when a stream closes, stream_state releases its concurrency slot and clears the stream's contents but leaves the table entry in place, and nothing in the distribution deletes it (CWE-401). A remote peer triggers this by opening and closing ordinary, accepted streams in sequence on one HTTP/2 connection; roughly 920 bytes are retained per closed stream, so 100,000 sequential streams grow server resident memory by about 88 MiB, and SETTINGS_MAX_CONCURRENT_STREAMS does not bound the growth because it only caps simultaneously live streams. The residual entries accumulate for the life of the connection, so an unauthenticated attacker can drive the process into memory exhaustion and cause a denial of service (availability impact only, CVSS 7.5). Both sides are affected: servers grow the table against a hostile client, and clients built on the module grow it the same way against a hostile server. Any operator of a Perl service or client using Protocol::HTTP2 is exposed; there is no public PoC, the flaw is not in CISA KEV, and EPSS rates 30-day exploitation probability at 0.6%, so no exploitation is known.
  · CPAN (Perl) Protocol::HTTP2 all versions before 1.14niche

Appears with