CVE-2026-49942
HIGHDescription
Net::CIDR::Set versions through 0.20 for Perl did not validate network masks. The mask portion of a network mask could contain Unicode digits such as the Arabic-Indic One (U+0661), or non-digits, which were ignored. This could allow network masks to accept larger networks. Leading zeros were also accepted, but treated as decimal instead of octal. This could lead to confusion about what networks are acceptable.
Is your site exposed to CVE-2026-49942?
Run a free security scan — no signup, results in seconds.
CVSS v3.1 Score
EPSS — Exploit Prediction
EPSS estimates the probability that this vulnerability will be exploited in the wild within the next 30 days. A higher score means more likely to be exploited.
Weakness Type (CWE)
Affected Products
| Vendor | Product |
|---|---|
| rrwo | net\ |
References
Frequently Asked Questions
What is CVE-2026-49942? +
How severe is CVE-2026-49942? +
What products are affected by CVE-2026-49942? +
How do I check if I'm vulnerable to CVE-2026-49942? +
Related Vulnerabilities
Handlebars provides the power necessary to let users build semantic templates. From 3.0.0 until 4.7.10, Handlebars lookupProperty returns Function.prototype.constructor before …
The mod_auth module in OTP's inets httpd server, when configured with dets or mnesia authentication backends and multiple directory configuration …
Symfony Polyfill backports PHP features and provides compatibility layers for extensions and functions. From 1.17.1 until 1.38.1, symfony/polyfill-intl-idn accepts xn-- …
In affected versions of Octopus Server, an authenticated user with permission to modify roles could bypass the protections preventing access …
Improper Validation of Unsafe Equivalence in Input in ZenHive mpp allows an unauthenticated remote client to pass the Tempo duplicate-submission …
A server-side request forgery issue due to improper validation of equivalent address representations in the port forwarding to remote hosts …