CVE-2026-86287

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-86287
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-86287.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-86287
Published
2026-09-07T18:25:37Z
Modified
2026-09-10T08:14:09Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
Net::IP::LPM versions before 1.12 for Perl accept malformed prefix lengths
Details

Net::IP::LPM versions before 1.12 for Perl accept malformed prefix lengths.

Non-numeric and non-ASCII prefix lengths are accepted and treated as 0. Integers over 31 bits are silently truncated. A single malformed mask will poison the lookup table.

The result is that the lookup will silently succeed for every address. An allow-list will allow every address, and a deny-list will block every address.

Database specific 
{
    "cna_assigner": "CPANSec",
    "cwe_ids": [
        "CWE-1287"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/86xxx/CVE-2026-86287.json"
}
References

Affected packages

Git / github.com/robrwo/perl-net-ip-lpm

Affected ranges

Type
GIT
Repo
https://github.com/robrwo/perl-net-ip-lpm
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
77cb686c281c60af48aaaea95d3c660f68e7d718
Fixed
814f8baa85537827db8c3b3d251e48db7aca318f
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "1.12"
        }
    ],
    "source": [
        "DESCRIPTION",
        "REFERENCES"
    ]
}

Affected versions

1.*
1.10
1.11

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-86287.json"
vanir_signatures 
[
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "116444461387459899273795148110262149926",
                "329904267858263137535713598440271635907",
                "134191461644986879305567605051416305100",
                "335526329950323617585510225752551235522"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-86287-12a527dd",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/robrwo/perl-net-ip-lpm/commit/814f8baa85537827db8c3b3d251e48db7aca318f",
        "target": {
            "file": "lpm_lib.h"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "281458864089424611864647396827165409288",
            "length": 720
        },
        "id": "CVE-2026-86287-3550f969",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/robrwo/perl-net-ip-lpm/commit/814f8baa85537827db8c3b3d251e48db7aca318f",
        "target": {
            "file": "lpm_lib.c",
            "function": "lpm_add_raw"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "133716966414464945561939849935186368307",
                "104938777383027312420465892620093067490",
                "217970877141231856692763960970513125011",
                "143514747948762974710482617334843493909",
                "309029558583900909792665107173015688822",
                "273512466423736018003054777335581844630",
                "145057360490517573925774201350977026869",
                "193377297154486849009136667164352540960",
                "76692168131088571079169130524339098237",
                "107406994951632860111617575819698348348",
                "31716989054753269681234247624094874323"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-86287-bdac16cd",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/robrwo/perl-net-ip-lpm/commit/814f8baa85537827db8c3b3d251e48db7aca318f",
        "target": {
            "file": "lpm_lib.c"
        }
    }
]
vanir_signatures_modified 
"2026-09-10T08:14:09Z"