https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 15 Oct 2026 21:16:05 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-364387 EUVD-2026-364387 https://cve.radiocsirt.org/vuln/euvd-2026-364387 https://cve.radiocsirt.org/vuln/fkie_cve-2026-56015 <p>Net::IP::LPM versions before 1.11 for Perl allow a heap out-of-bounds read via an unbounded prefix length.</p> <p>add() passes the prefix string to the trie builder addPrefixToTrie() without checking it against the address width.</p> <p>addPrefixToTrie() then walks the prefix buffer by prefix_length bits, reading prefix[byte] for byte up to prefix_len/8, where prefix is the 4-byte (IPv4) or 16-byte (IPv6) packed address. A prefix length greater than 32 for IPv4 or 128 for IPv6, for example add(&#34;1.2.3.4/255&#34;, $v) or add(&#34;2001:db8::/255&#34;, $v), reads past the end of the packed address.</p> <p>The out-of-bounds read happens during trie construction and is bounded: the prefix length is stored as an unsigned char, so the bit walk reads at most 32 bytes from the start of the packed address, a short distance past the end of the 4-byte or 16-byte buffer. It is detectable under AddressSanitizer, valgrind, or a hardened allocator, where it can abort the process. Lookups and dump() format only the valid address width, so the out-of-bounds bytes are not exposed through the module&#39;s API.</p> <p>Net::IP::LPM versions before 1.11 for Perl allow a heap out-of-bounds read via an unbounded prefix length.</p> <p>add() passes the prefix string to the trie builder addPrefixToTrie() without checking it against the address width.</p> <p>addPrefixToTrie() then walks the prefix buffer by prefix_length bits, reading prefix[byte] for byte up to prefix_len/8, where prefix is the 4-byte (IPv4) or 16-byte (IPv6) packed address. A prefix length greater than 32 for IPv4 or 128 for IPv6, for example add(&#34;1.2.3.4/255&#34;, $v) or add(&#34;2001:db8::/255&#34;, $v), reads past the end of the packed address.</p> <p>The out-of-bounds read happens during trie construction and is bounded: the prefix length is stored as an unsigned char, so the bit walk reads at most 32 bytes from the start of the packed address, a short distance past the end of the 4-byte or 16-byte buffer. It is detectable under AddressSanitizer, valgrind, or a hardened allocator, where it can abort the process. Lookups and dump() format only the valid address width, so the out-of-bounds bytes are not exposed through the module&#39;s API.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-56015 https://cve.radiocsirt.org/vuln/ghsa-q2wj-rfvr-wf9p <p>Net::IP::LPM versions through 1.10 for Perl allow a heap out-of-bounds read via an unbounded prefix length.</p> <p>add() passes the prefix string to the trie builder addPrefixToTrie() without checking it against the address width.</p> <p>addPrefixToTrie() then walks the prefix buffer by prefix_length bits, reading prefix[byte] for byte up to prefix_len/8, where prefix is the 4-byte (IPv4) or 16-byte (IPv6) packed address. A prefix length greater than 32 for IPv4 or 128 for IPv6, for example add(&#34;1.2.3.4/255&#34;, $v) or add(&#34;2001:db8::/255&#34;, $v), reads past the end of the packed address.</p> <p>The out-of-bounds read happens during trie construction and is bounded: the prefix length is stored as an unsigned char, so the bit walk reads at most 32 bytes from the start of the packed address, a short distance past the end of the 4-byte or 16-byte buffer. It is detectable under AddressSanitizer, valgrind, or a hardened allocator, where it can abort the process. Lookups and dump() format only the valid address width, so the out-of-bounds bytes are not exposed through the module&#39;s API.</p> <p>Net::IP::LPM versions through 1.10 for Perl allow a heap out-of-bounds read via an unbounded prefix length.</p> <p>add() passes the prefix string to the trie builder addPrefixToTrie() without checking it against the address width.</p> <p>addPrefixToTrie() then walks the prefix buffer by prefix_length bits, reading prefix[byte] for byte up to prefix_len/8, where prefix is the 4-byte (IPv4) or 16-byte (IPv6) packed address. A prefix length greater than 32 for IPv4 or 128 for IPv6, for example add(&#34;1.2.3.4/255&#34;, $v) or add(&#34;2001:db8::/255&#34;, $v), reads past the end of the packed address.</p> <p>The out-of-bounds read happens during trie construction and is bounded: the prefix length is stored as an unsigned char, so the bit walk reads at most 32 bytes from the start of the packed address, a short distance past the end of the 4-byte or 16-byte buffer. It is detectable under AddressSanitizer, valgrind, or a hardened allocator, where it can abort the process. Lookups and dump() format only the valid address width, so the out-of-bounds bytes are not exposed through the module&#39;s API.</p> https://cve.radiocsirt.org/vuln/ghsa-q2wj-rfvr-wf9p