CVE-2026-19566

CVE-2026-19566 in Net::CIDR::Set has two distinct failure modes that warrant separate defensive consideration, even though they share a common root cause in the library's auto-detection design. The primary risk is the _guess_coder() fallback mechanism. This function attempts IPv4 parsing first, then falls back to IPv6 parsing. The critical insight: an application that restricts itself to IPv4 addresses still passes untrusted input through the IPv6 codepath before any width validation occurs. The oversized prefix allocation happens before the mixed-address-width check rejects it, so the attack succeeds even against explicit IPv4-only use cases. If you believe you've limited exposure by constraining input to IPv4, you're actually passing potentially malicious values through the vulnerable code path anyway. Check whether any Net::CIDR::Set instantiation in your environment processes untrusted CIDR input — the library's auto-detection means IPv4-only intent does not imply IPv4-only execution. The secondary risk is the /129 semantic corruption. A prefix length above 128 stores as a range that does not match its own base address, producing inconsistent behavior where the set stringifies unchanged and reports covering the address, but contains() returns false. This is a silent logic bomb: memory exhaustion is loud and triggers OOM logs, but /129 corruption is silent. It survives serialization intact, propagating to downstream consumers like firewall rule distributors, network ACL systems, and infrastructure-as-code state files. A corrupted set embedded in a Terraform statefile will persist for months or years without anyone noticing that contains() returns false for an address the set claims to cover. Prioritize patching, but also audit any serialized Net::CIDR::Set data in backups, state files, or version control — the corruption may have already escaped the original process. If you cannot patch immediately, consider input validation at your application boundary that rejects prefix lengths exceeding 128 before passing CIDR strings to this library.

Reviewed through automated stages and approved by a human before publication.