---
id: CVE-2025-40910
title: >-
  Net::IP::LPM version 1.10 for Perl does not properly consider leading zero
  characters in IP CIDR address strings, which could allow attackers to bypass
  access control that is based on IP addresses.


  Leading zeros are used to indicate oct…
summary: >-
  Net::IP::LPM version 1.10 for Perl does not properly consider leading zero
  characters in IP CIDR address strings, which could allow attackers to bypass
  access control that is based on IP addresses.


  Leading zeros are used to indicate oct…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N'
cwe:
  - CWE-1287
product: Net-IP-LPM
affected:
  - Net-IP-LPM 1.10
published: '2025-06-27'
updated: '2026-09-07'
sourceUpdated: '2026-09-07T19:17:24.773'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-40910'
references:
  - url: >-
      https://blog.urth.org/2021/03/29/security-issues-in-perl-ip-address-distros/
    label: 9b29abf9-4ab0-4765-b253-1875cd9b441e
  - url: 'https://metacpan.org/release/RRWO/Net-IP-LPM-1.11/changes'
    label: 9b29abf9-4ab0-4765-b253-1875cd9b441e
  - url: >-
      https://metacpan.org/release/TPODER/Net-IP-LPM-1.10/diff/TPODER/Net-IP-LPM-1.09/lib/Net/IP/LPM.pm
    label: 9b29abf9-4ab0-4765-b253-1875cd9b441e
  - url: 'https://rt.cpan.org/Ticket/Display.html?id=179855'
    label: 9b29abf9-4ab0-4765-b253-1875cd9b441e
  - url: >-
      https://security.metacpan.org/patches/N/Net-IP-LPM/1.10/CVE-2025-40910-r1.patch
    label: 9b29abf9-4ab0-4765-b253-1875cd9b441e
tags:
  - nvd
  - cve.org
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2025-06-27T20:06:14.573534Z'
epss: 0.00311
epssPercentile: 0.24247
ingestedAt: '2026-07-03T13:25:30.612Z'
---

## Overview

Net::IP::LPM version 1.10 for Perl does not properly consider leading zero characters in IP CIDR address strings, which could allow attackers to bypass access control that is based on IP addresses.

Leading zeros are used to indicate octal numbers, which can confuse users who are intentionally using octal notation, as well as users who believe they are using decimal notation.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.