CVE-2026-86287: Net::IP::LPM versions before 1.12 for Perl accept malformed prefix lengths
CVE-2026-86287: Net::IP::LPM Perl library before 1.12 accepts malformed IP prefix lengths, risking incorrect longest-prefix-match results.
Net::IP::LPM versions before 1.12 for Perl accept malformed prefix lengths, per an oss-security disclosure posted September 7, 2026. The lax input validation in this longest-prefix-match library could produce incorrect matching behavior. The fix is available in version 1.12 on CPAN.
- Fixed in Net::IP::LPM 1.12, available on CPAN
- Malformed prefix lengths accepted, risking incorrect longest-prefix-match behavior
- Disclosed on the oss-security mailing list on September 7, 2026
- CVEs
- CVE-2026-86287
- Products
- Net::IP::LPM
- Organizations
- CPAN
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-86287 | Improper Input Validation in Net::IP::LPM Perl Module Lets Bad Masks Poison Lookups | 7.5 | <1% |
From the original article
Posted by Robert Rothenberg on Sep 07 ======================================================================== https://metacpan. org/dist/Net-IP-LPM VCS Repo: ...
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.