{"id":"CVE-2026-56015","title":"Net::IP::LPM versions before 1.11 for Perl allow a heap out-of-bounds read via an unbounded prefix length.\n\nadd() passes the prefix string to the trie builder addPrefixToTrie() without checking it against the address width.\n\naddPrefixToT…","summary":"Net::IP::LPM versions before 1.11 for Perl allow a heap out-of-bounds read via an unbounded prefix length.\n\nadd() passes the prefix string to the trie builder addPrefixToTrie() without checking it against the address width.\n\naddPrefixToT…","severity":"critical","cvss":9.1,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","cwe":["CWE-125"],"product":"Net-IP-LPM","affected":["Net-IP-LPM < 1.11"],"published":"2026-07-03","updated":"2026-09-07","sourceUpdated":"2026-09-07T19:17:26.970","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-56015","references":[{"url":"https://metacpan.org/release/RRWO/Net-IP-LPM-1.11/changes","label":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"url":"https://rt.cpan.org/Ticket/Display.html?id=179856","label":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"url":"https://security.metacpan.org/patches/N/Net-IP-LPM/1.10/CVE-2026-56015-r2.patch","label":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"url":"http://www.openwall.com/lists/oss-security/2026/07/03/4","label":"af854a3a-2127-422b-91ae-364da2661108"}],"tags":["nvd","cve.org"],"ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"partial","timestamp":"2026-07-06T18:35:54.436194Z"},"epss":0.00653,"epssPercentile":0.4952,"ingestedAt":"2026-07-04T09:56:00.571Z","slug":"CVE-2026-56015","body":"## Overview\n\nNet::IP::LPM versions before 1.11 for Perl allow a heap out-of-bounds read via an unbounded prefix length.\n\nadd() passes the prefix string to the trie builder addPrefixToTrie() without checking it against the address width.\n\naddPrefixToTrie() then walks the prefix buffer by prefix_length bits, reading prefix[byte] for byte up to prefix_len/8, where prefix is the 4-byte (IPv4) or 16-byte (IPv6) packed address. A prefix length greater than 32 for IPv4 or 128 for IPv6, for example add(\"1.2.3.4/255\", $v) or add(\"2001:db8::/255\", $v), reads past the end of the packed address.\n\nThe out-of-bounds read happens during trie construction and is bounded: the prefix length is stored as an unsigned char, so the bit walk reads at most 32 bytes from the start of the packed address, a short distance past the end of the 4-byte or 16-byte buffer. It is detectable under AddressSanitizer, valgrind, or a hardened allocator, where it can abort the process. Lookups and dump() format only the valid address width, so the out-of-bounds bytes are not exposed through the module's API.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"midnight","depthScore":50,"depthScoreParts":{"impact":50.1,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":5357,"id":"CVE-2026-56015","ts":1788887271729,"field":"cvss","old":null,"new":"9.1"},{"seq":5356,"id":"CVE-2026-56015","ts":1788887271729,"field":"severity","old":"none","new":"critical"},{"seq":4240,"id":"CVE-2026-56015","ts":1788886386780,"field":"cvss","old":"9.1","new":null},{"seq":4239,"id":"CVE-2026-56015","ts":1788886386780,"field":"severity","old":"critical","new":"none"},{"seq":2996,"id":"CVE-2026-56015","ts":1788883050184,"field":"cvss","old":null,"new":"9.1"},{"seq":2995,"id":"CVE-2026-56015","ts":1788883050184,"field":"severity","old":"none","new":"critical"},{"seq":2025,"id":"CVE-2026-56015","ts":1788882454780,"field":"cvss","old":"9.1","new":null},{"seq":2024,"id":"CVE-2026-56015","ts":1788882454780,"field":"severity","old":"critical","new":"none"},{"seq":260,"id":"CVE-2026-56015","ts":1788881643070,"field":"cvss","old":null,"new":"9.1"},{"seq":259,"id":"CVE-2026-56015","ts":1788881643070,"field":"severity","old":"none","new":"critical"}]}