{"id":"CVE-2026-86287","summary":"Net::IP::LPM versions before 1.12 for Perl accept malformed prefix lengths","details":"Net::IP::LPM versions before 1.12 for Perl accept malformed prefix lengths.\n\nNon-numeric and non-ASCII prefix lengths are accepted and treated as 0. Integers over 31 bits are silently truncated.  A single malformed mask will poison the lookup table.\n\nThe result is that the lookup will silently succeed for every address. An allow-list will allow every address, and a deny-list will block every address.","modified":"2026-09-10T08:14:09.968907Z","published":"2026-09-07T18:25:37.140Z","database_specific":{"cna_assigner":"CPANSec","cwe_ids":["CWE-1287"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/86xxx/CVE-2026-86287.json"},"references":[{"type":"WEB","url":"http://www.openwall.com/lists/oss-security/2026/09/07/1"},{"type":"WEB","url":"https://cpan.org/modules"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/86xxx/CVE-2026-86287.json"},{"type":"ADVISORY","url":"https://metacpan.org/release/RRWO/Net-IP-LPM-1.12/changes"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-86287"},{"type":"FIX","url":"https://github.com/robrwo/perl-Net-IP-LPM/commit/814f8baa85537827db8c3b3d251e48db7aca318f.patch"},{"type":"PACKAGE","url":"https://github.com/robrwo/perl-Net-IP-LPM"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/robrwo/perl-net-ip-lpm","events":[{"introduced":"0"},{"fixed":"77cb686c281c60af48aaaea95d3c660f68e7d718"},{"fixed":"814f8baa85537827db8c3b3d251e48db7aca318f"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"1.12"}],"source":["DESCRIPTION","REFERENCES"]}}],"versions":["1.11","1.10"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-86287.json","vanir_signatures_modified":"2026-09-10T08:14:09Z","vanir_signatures":[{"deprecated":false,"digest":{"line_hashes":["116444461387459899273795148110262149926","329904267858263137535713598440271635907","134191461644986879305567605051416305100","335526329950323617585510225752551235522"],"threshold":0.9},"id":"CVE-2026-86287-12a527dd","signature_type":"Line","signature_version":"v1","source":"https://github.com/robrwo/perl-net-ip-lpm/commit/814f8baa85537827db8c3b3d251e48db7aca318f","target":{"file":"lpm_lib.h"}},{"signature_version":"v1","source":"https://github.com/robrwo/perl-net-ip-lpm/commit/814f8baa85537827db8c3b3d251e48db7aca318f","target":{"file":"lpm_lib.c","function":"lpm_add_raw"},"deprecated":false,"digest":{"function_hash":"281458864089424611864647396827165409288","length":720},"id":"CVE-2026-86287-3550f969","signature_type":"Function"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/robrwo/perl-net-ip-lpm/commit/814f8baa85537827db8c3b3d251e48db7aca318f","target":{"file":"lpm_lib.c"},"deprecated":false,"digest":{"line_hashes":["133716966414464945561939849935186368307","104938777383027312420465892620093067490","217970877141231856692763960970513125011","143514747948762974710482617334843493909","309029558583900909792665107173015688822","273512466423736018003054777335581844630","145057360490517573925774201350977026869","193377297154486849009136667164352540960","76692168131088571079169130524339098237","107406994951632860111617575819698348348","31716989054753269681234247624094874323"],"threshold":0.9},"id":"CVE-2026-86287-bdac16cd"}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}]}