{
  "cveId": "CVE-2021-4456",
  "url": "https://patchblox.com/security/cve/CVE-2021-4456",
  "summary": "CVE-2021-4456 is fixed in libnet-cidr-perl on 1 platform, first by libnet-cidr-perl 0.18-1ubuntu0.1~esm2, released February 26, 2026. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "libnet-cidr-perl: Net::CIDR versions before 0.24 for Perl mishandle leading zeros in IP CIDR addresses, which may have unspecified impact",
  "description": "Net::CIDR versions before 0.24 for Perl mishandle leading zeros in IP CIDR addresses, which may have unspecified impact. The functions \u0060addr2cidr\u0060 and \u0060cidrlookup\u0060 may return leading zeros in a CIDR string, which may in turn be parsed as octal numbers by subsequent users. In some cases an attacker may be able to leverage this to bypass access controls based on IP addresses. The documentation advises validating untrusted CIDR strings with the \u0060cidrvalidate\u0060 function. However, this mitigation is optional and not enforced by default. In practice, users may call \u0060addr2cidr\u0060 or \u0060cidrlookup\u0060 with untrusted input and without validation, incorrectly assuming that this is safe.",
  "published": "2026-02-26T17:16:00Z",
  "severity": "Medium",
  "cvss": 6.5,
  "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
  "epss": 0.00374,
  "epssPercentile": 0.31628,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "libnet-cidr-perl",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "0.25-1",
      "fix": "DEBIAN-CVE-2021-4456",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2021-4456",
      "released": "2026-02-27T01:16:13Z"
    },
    {
      "platform": "linux",
      "product": "libnet-cidr-perl",
      "release": "Debian 14",
      "fixedVersion": "0.25-1",
      "fix": "DEBIAN-CVE-2021-4456",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2021-4456",
      "released": "2026-02-27T01:16:13Z"
    },
    {
      "platform": "linux",
      "product": "libnet-cidr-perl",
      "release": "Ubuntu 18.04.6 LTS (bionic)",
      "fixedVersion": "0.18-1ubuntu0.1~esm2",
      "fix": "libnet-cidr-perl 0.18-1ubuntu0.1~esm2",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-bionic-libnet-cidr-perl-0.18-1ubuntu0.1-esm2",
      "released": "2026-02-26T17:16:00Z"
    },
    {
      "platform": "linux",
      "product": "libnet-cidr-perl",
      "release": "Ubuntu 20.04 LTS (focal)",
      "fixedVersion": "0.20-1ubuntu0.1~esm2",
      "fix": "libnet-cidr-perl 0.20-1ubuntu0.1~esm2",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-focal-libnet-cidr-perl-0.20-1ubuntu0.1-esm2",
      "released": "2026-02-26T17:16:00Z"
    },
    {
      "platform": "linux",
      "product": "libnet-cidr-perl",
      "release": "Ubuntu 22.04.1 LTS (jammy)",
      "fixedVersion": "0.21-1ubuntu0.2",
      "fix": "libnet-cidr-perl 0.21-1ubuntu0.2",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-jammy-libnet-cidr-perl-0.21-1ubuntu0.2",
      "released": "2026-02-26T17:16:00Z"
    },
    {
      "platform": "linux",
      "product": "libnet-cidr-perl",
      "release": "Ubuntu 24.04.5 LTS (noble)",
      "fixedVersion": "0.21-2ubuntu0.2",
      "fix": "libnet-cidr-perl 0.21-2ubuntu0.2",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-noble-libnet-cidr-perl-0.21-2ubuntu0.2",
      "released": "2026-02-26T17:16:00Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T13:06:02Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}