CVE-2021-4456Disclosure(mrsam / net\)

LOWCVSS 6.5 · MEDIUM

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch mrsam net\ systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Net::CIDR versions before 0.24 for Perl mishandle leading zeros in IP CIDR addresses, which may have unspecified impact. The functions `addr2cidr` and `cidrlookup` may return leading zeros in a CIDR string, which may in turn be parsed as octal numbers by subsequent users. In some cases an attacker may be able to leverage this to bypass access controls based on IP addresses. The documentation advises validating untrusted CIDR strings with the `cidrvalidate` function. However, this mitigation is optional and not enforced by default. In practice, users may call `addr2cidr` or `cidrlookup` with untrusted input and without validation, incorrectly assuming that this is safe.

mrsam CVEs Back to dashboard

0.5/ 10 priority

Sources & remediation

Patch / fix

https://github.com/svarshavchik/Net-CIDR/commit/e3648c6bc6bdd018f90cca4149c467017d42bd10

Vendor / third-party advisories

https://blog.urth.org/2021/03/29/security-issues-in-perl-ip-address-distros/

Other references

https://metacpan.org/dist/Net-CIDR/changes

Weakness type (CWE)

CWE-704

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

net\

Threat summary

Patch or workaround signal is available
3 mentions across 2 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 1 signal
Technical details provided in 3 signals
Disclosure: 1 classified signal
General: 1 classified signal
Peaked 1d ago at 2 mentions (2026-02-27); latest day: 1
3 total mentions across 2 days

Affected systems

Vendors

mrsam

Products

net\

1 version affected across 1 product

Deep dive

Activity timeline3 mentions / 2d

Signal classification3 categories

Disclosure

133.3%

General

133.3%

Patch

133.3%

Referenced assets3 URLs

By indicator

Classification over time

Date	Total	Labels

2026-02-27	2	Disclosure1General1
2026-03-10	1	Patch1

Full discourse3 posts

Ferramentas Linux@Cezar_H_Linux212d
Patch
Critical: #Fedora 42 perl-Net-CIDR update (0.27) fixes a leading zeros flaw (CVE-2021-4456). Before patch, 010.0.0.1 could be parsed as octal 8.0.0.1, breaking ACLs & routing. Patch strips zeros for canonical IPs. Read more: 👉 https://tinyurl.com/2s4mdwyy #Security https://t.co/Y4CWSAwMij
Post summary
The tweet announces a critical Fedora 42 update addressing CVE-2021-4456, a leading‑zeros flaw in perl‑Net‑CIDR that could misinterpret IP addresses, potentially breaking ACLs and routing. It notes the patch removes leading zeros to enforce canonical IP parsing.
0001045
1.3K followersView on X
Infoflowcloud@infoflowcloud223d
General
🚨*CVE* CVE-2021-4456 Net::CIDR versions before 0.24 for Perl mishandle leading zeros in IP CIDR addresses, which may have unspecified impact. The functions `addr2cidr` and `cidrlookup` may… https://www.cve.org/CVERecord?id=CVE-2021-4456 ----- Traducción: CVE-2021-4456 Net… http://infoflow.cloud`
Post summary
The tweet highlights CVE‑2021‑4456 affecting Net::CIDR before 0.24, noting a mishandling of leading zeros in IP CIDR addresses and an unspecified impact, without providing PoC, exploit, or patch details.
0000034
55 followersView on X
CVE@CVEnew223d
Disclosure
CVE-2021-4456 Net::CIDR versions before 0.24 for Perl mishandle leading zeros in IP CIDR addresses, which may have unspecified impact. The functions `addr2cidr` and `cidrlookup` may… https://www.cve.org/CVERecord?id=CVE-2021-4456
Post summary
The post notes that Net::CIDR versions before 0.24 misinterpret leading zeros in IP CIDR addresses, potentially leading to unspecified impact, but offers no PoC, exploit, or mitigation information.
00000164
56.6K followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	mrsam	net\	\	-	-

Explore more

Back to dashboard mrsam CVEs net\ vulnerabilities

What researchers are saying

CVE-2021-4456

Ferramentas Linux@Cezar_H_LinuxPatch

The tweet announces a critical Fedora 42 update addressing CVE-2021-4456, a leading‑zeros flaw in perl‑Net‑CIDR that could misinterpret IP addresses, potentially breaking ACLs and routing. It notes the patch removes leading zeros to enforce canonical IP parsing.

Infoflowcloud@infoflowcloudGeneral

The tweet highlights CVE‑2021‑4456 affecting Net::CIDR before 0.24, noting a mishandling of leading zeros in IP CIDR addresses and an unspecified impact, without providing PoC, exploit, or patch details.

CVE@CVEnewDisclosure

The post notes that Net::CIDR versions before 0.24 misinterpret leading zeros in IP CIDR addresses, potentially leading to unspecified impact, but offers no PoC, exploit, or mitigation information.