CVE Explorer
CVE-2026-56015
Net::IP::LPM versions through 1.10 for Perl allow a heap out-of-bounds read via an unbounded prefix length.
add() passes the prefix string to the trie builder addPrefixToTrie() without checking it against the address width.
addPrefixToTrie() then walks the prefix buffer by prefix_length bits, reading prefix[byte] for byte up to prefix_len/8, where prefix is the 4-byte (IPv4) or 16-byte (IPv6) packed address. A prefix length greater than 32 for IPv4 or 128 for IPv6, for example add("1.2.3.4/255
Known exploited
Not asserted
Disputed
No
Stale source
No
Conflicts
0
Affected products and versions
1 source assertion{"collectionURL":"https://cpan.org/modules","defaultStatus":"unaffected","packageName":"Net-IP-LPM","product":"Net::IP::LPM","programFiles":["lib/Net/IP/LPM.pm","lpm_lib.c"],"programRoutines":[{"name":"Net::IP::LPM::add"},{"name":"addPrefixToTrie"},{"name":"lpm_add_raw"}],"vendor":"TPODER","versions":[{"lessThanOrEqual":"1.10","status":"affected","version":"0","versionType":"custom"}]}
- cve_program_cvelist_v5affectedurn:baitaphish:normalized-source-record:v2:5386cdd26c4d72e95e91adac615d2695ecabf5731fe88c6378a6340e421e04ab · sha256:3a08bb453bdf9cd8… · /containers/cna/affected/0
Provider-owned CVSS observations
1 source assertion{"metric":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.1,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","version":"3.1"},"metric_type":"cvssV3_1"}
- cve_program_cvelist_v5cvssurn:baitaphish:normalized-source-record:v2:5386cdd26c4d72e95e91adac615d2695ecabf5731fe88c6378a6340e421e04ab · sha256:3a08bb453bdf9cd8… · /containers/adp/1/metrics/0/cvssV3_1
CWE assertions
1 source assertion{"cweId":"CWE-125","description":"CWE-125 Out-of-bounds Read","lang":"en","type":"CWE"}
- cve_program_cvelist_v5cweurn:baitaphish:normalized-source-record:v2:5386cdd26c4d72e95e91adac615d2695ecabf5731fe88c6378a6340e421e04ab · sha256:3a08bb453bdf9cd8… · /containers/cna/problemTypes/0/descriptions/0
Source references
3 source assertions{"url":"http://www.openwall.com/lists/oss-security/2026/07/03/4"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:5386cdd26c4d72e95e91adac615d2695ecabf5731fe88c6378a6340e421e04ab · sha256:3a08bb453bdf9cd8… · /containers/adp/0/references/0
{"tags":["issue-tracking","vendor-advisory"],"url":"https://rt.cpan.org/Ticket/Display.html?id=179856"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:5386cdd26c4d72e95e91adac615d2695ecabf5731fe88c6378a6340e421e04ab · sha256:3a08bb453bdf9cd8… · /containers/cna/references/0
{"tags":["patch"],"url":"https://security.metacpan.org/patches/N/Net-IP-LPM/1.10/CVE-2026-56015-r2.patch"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:5386cdd26c4d72e95e91adac615d2695ecabf5731fe88c6378a6340e421e04ab · sha256:3a08bb453bdf9cd8… · /containers/cna/references/1
Attribution and limitations
- CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →
Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.