{"id":"CVE-2026-86287","title":"Net::IP::LPM versions before 1.12 for Perl accept malformed prefix lengths.\n\nNon-numeric and non-ASCII prefix lengths are accepted and treated as 0","summary":"Net::IP::LPM versions before 1.12 for Perl accept malformed prefix lengths.\n\nNon-numeric and non-ASCII prefix lengths are accepted and treated as 0. Integers over 31 bits are silently truncated.  A single malformed mask will poison the l…","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwe":["CWE-1287"],"product":"Net-IP-LPM","affected":["Net-IP-LPM < 1.12"],"published":"2026-09-07","updated":"2026-09-08","sourceUpdated":"2026-09-08T19:20:13.267","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-86287","references":[{"url":"https://github.com/robrwo/perl-Net-IP-LPM/commit/814f8baa85537827db8c3b3d251e48db7aca318f.patch","label":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"url":"https://metacpan.org/release/RRWO/Net-IP-LPM-1.12/changes","label":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"url":"http://www.openwall.com/lists/oss-security/2026/09/07/1","label":"af854a3a-2127-422b-91ae-364da2661108"}],"tags":["nvd","cve.org"],"ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"partial","timestamp":"2026-09-08T18:40:16.712696Z"},"epss":0.00385,"epssPercentile":0.32314,"ingestedAt":"2026-09-08T15:33:26.980Z","slug":"CVE-2026-86287","body":"## Overview\n\nNet::IP::LPM versions before 1.12 for Perl accept malformed prefix lengths.\n\nNon-numeric and non-ASCII prefix lengths are accepted and treated as 0. Integers over 31 bits are silently truncated.  A single malformed mask will poison the lookup table.\n\nThe result is that the lookup will silently succeed for every address. An allow-list will allow every address, and a deny-list will block every address.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":8341,"id":"CVE-2026-86287","ts":1788919998439,"field":"cvss","old":null,"new":"7.5"},{"seq":8340,"id":"CVE-2026-86287","ts":1788919998439,"field":"severity","old":"none","new":"high"},{"seq":8150,"id":"CVE-2026-86287","ts":1788919290131,"field":"cvss","old":"7.5","new":null},{"seq":8149,"id":"CVE-2026-86287","ts":1788919290131,"field":"severity","old":"high","new":"none"},{"seq":7959,"id":"CVE-2026-86287","ts":1788916360569,"field":"cvss","old":null,"new":"7.5"},{"seq":7958,"id":"CVE-2026-86287","ts":1788916360569,"field":"severity","old":"none","new":"high"},{"seq":7768,"id":"CVE-2026-86287","ts":1788915307841,"field":"cvss","old":"7.5","new":null},{"seq":7767,"id":"CVE-2026-86287","ts":1788915307841,"field":"severity","old":"high","new":"none"},{"seq":7577,"id":"CVE-2026-86287","ts":1788912721956,"field":"cvss","old":null,"new":"7.5"},{"seq":7576,"id":"CVE-2026-86287","ts":1788912721956,"field":"severity","old":"none","new":"high"},{"seq":7386,"id":"CVE-2026-86287","ts":1788911340088,"field":"cvss","old":"7.5","new":null},{"seq":7385,"id":"CVE-2026-86287","ts":1788911340088,"field":"severity","old":"high","new":"none"},{"seq":7190,"id":"CVE-2026-86287","ts":1788909080849,"field":"cvss","old":null,"new":"7.5"},{"seq":7189,"id":"CVE-2026-86287","ts":1788909080849,"field":"severity","old":"none","new":"high"},{"seq":7002,"id":"CVE-2026-86287","ts":1788907396511,"field":"cvss","old":"7.5","new":null},{"seq":7001,"id":"CVE-2026-86287","ts":1788907396511,"field":"severity","old":"high","new":"none"},{"seq":6804,"id":"CVE-2026-86287","ts":1788905446659,"field":"cvss","old":null,"new":"7.5"},{"seq":6803,"id":"CVE-2026-86287","ts":1788905446659,"field":"severity","old":"none","new":"high"},{"seq":6622,"id":"CVE-2026-86287","ts":1788903463449,"field":"cvss","old":"7.5","new":null},{"seq":6621,"id":"CVE-2026-86287","ts":1788903463449,"field":"severity","old":"high","new":"none"},{"seq":6408,"id":"CVE-2026-86287","ts":1788901812648,"field":"cvss","old":null,"new":"7.5"},{"seq":6407,"id":"CVE-2026-86287","ts":1788901812648,"field":"severity","old":"none","new":"high"},{"seq":6238,"id":"CVE-2026-86287","ts":1788899563113,"field":"cvss","old":"7.5","new":null},{"seq":6237,"id":"CVE-2026-86287","ts":1788899563113,"field":"severity","old":"high","new":"none"},{"seq":6000,"id":"CVE-2026-86287","ts":1788898181440,"field":"cvss","old":null,"new":"7.5"},{"seq":5999,"id":"CVE-2026-86287","ts":1788898181440,"field":"severity","old":"none","new":"high"},{"seq":5889,"id":"CVE-2026-86287","ts":1788895712035,"field":"cvss","old":"7.5","new":null},{"seq":5888,"id":"CVE-2026-86287","ts":1788895712035,"field":"severity","old":"high","new":"none"},{"seq":5754,"id":"CVE-2026-86287","ts":1788894572860,"field":"cvss","old":null,"new":"7.5"},{"seq":5753,"id":"CVE-2026-86287","ts":1788894572860,"field":"severity","old":"none","new":"high"}]}