CVE-2026-49942
CVE-2026-49942 is a high-severity vulnerability in Rrwo Net with a CVSS 3.x base score of 7.3. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-1289.
Key facts
- Severity: High (CVSS 3.x base score 7.3)
- EPSS exploit prediction: 0% (23rd percentile)
- Actively exploited: Not listed in CISA KEV
- EU (EUVD) id: EUVD-2026-34299
- Weakness: CWE-1289
- Affected product: Rrwo Net
- Published:
- Last modified:
Description
Net::CIDR::Set versions through 0.20 for Perl did not validate network masks. The mask portion of a network mask could contain Unicode digits such as the Arabic-Indic One (U+0661), or non-digits, which were ignored. This could allow network masks to accept larger networks. Leading zeros were also accepted, but treated as decimal instead of octal. This could lead to confusion about what networks are acceptable.
Frequently asked questions
- What is CVE-2026-49942?
- Net::CIDR::Set versions through 0.20 for Perl did not validate network masks. The mask portion of a network mask could contain Unicode digits such as the Arabic-Indic One (U+0661), or non-digits, which were ignored. This could allow network masks to accept larger networks. Leading zeros were also accepted, but treated as decimal instead of octal. This could lead to confusion about what networks are acceptable.
- How severe is CVE-2026-49942?
- CVE-2026-49942 has a CVSS 3.x base score of 7.3, rated high severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is low, integrity low, and availability low.
- Is CVE-2026-49942 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (23rd percentile), an estimate of the probability of exploitation in the next 30 days.
- What products are affected by CVE-2026-49942?
- CVE-2026-49942 affects Rrwo Net. See the affected-products list for the exact vulnerable versions.
- How do I fix CVE-2026-49942?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
- Does CVE-2026-49942 have an EU (EUVD) identifier?
- Yes. CVE-2026-49942 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-34299.
- When was CVE-2026-49942 published?
- CVE-2026-49942 was published on 2026-06-04 and last updated on 2026-06-17.
References
- https://metacpan.org/release/RRWO/Net-CIDR-Set-0.21/changes
- https://nvd.nist.gov/vuln/detail/CVE-2025-40911
- https://nvd.nist.gov/vuln/detail/CVE-2026-45191
Affected products (1)
- cpe:2.3:a:rrwo:net\:\:cidr\:\:set:*:*:*:*:*:perl:*:*
Other CWE-1289 vulnerabilities
- CVE-2026-39821 — Critical (CVSS 9.6): The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For…
- CVE-2026-50090 — Critical (CVSS 9.3): The Aqara Cloud OAuth Authorization Endpoint (open-cn.aqara.com/oauth/authorize) is vulnerable to a redirect bypass due…
- CVE-2024-42219 — High (CVSS 7.8): 1Password 8 before 8.10.36 for macOS allows local attackers to exfiltrate vault items because XPC inter-process…
- CVE-2024-45179 — High (CVSS 7.2): An issue was discovered in za-internet C-MOR Video Surveillance 5.2401 and 6.00PL01. Due to insufficient input…
- CVE-2026-39972 — High (CVSS 7.1): Mercure is a protocol for pushing data updates to web browsers and other HTTP clients in a battery-efficient way. Prior…
- CVE-2026-49940 — Medium (CVSS 6.5): Net::CIDR::Set versions through 0.20 for Perl accept non-ASCII IP addresses and netmasks. Unicode digits such as the…