Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-86287— Net::IP::LPM versions before 1.12 for Perl accept malformed prefix lengths

Quick assessment

Affected
CVE-2026-86287
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Net::IP::LPM 1.12 之前版本的 Perl 模块会接受格式错误的子网前缀长度。 非数字或非 ASCII 字符的前缀长度会被接受并视为 0，而超过 31 位的整数前缀长度会被静默截断。一个格式错误的掩码会“污染”查找表。 其结果是，对于所有地址的查找都会静默返回“匹配成功”。这意味着： 如果使用允许列表（allow-list），则所有地址都会被允许； 如果使用拒绝列表（deny-list），则所有地址都会被阻止。

AI Predicted 5.0 Difficulty: Moderate EPSS 0.39% · P32

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Affected Version Matrix 1

VendorProduct Version RangeStatus
None None < 1.12 affected

I. Basic Information for CVE-2026-86287

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Net::IP::LPM versions before 1.12 for Perl accept malformed prefix lengths
Source: CVE Program / CVE List V5
Vulnerability Description
Net::IP::LPM versions before 1.12 for Perl accept malformed prefix lengths. Non-numeric and non-ASCII prefix lengths are accepted and treated as 0. Integers over 31 bits are silently truncated. A single malformed mask will poison the lookup table. The result is that the lookup will silently succeed for every address. An allow-list will allow every address, and a deny-list will block every address.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
CWE-1287
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
- - 0 ~ 1.12 -

II. Public POCs for CVE-2026-86287

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-86287

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-86287 (1)

Vendor Pages for CVE-2026-86287 (1)

IV. Related Vulnerabilities

Same weakness: CWE-1287

V. Comments for CVE-2026-86287

No comments yet

Leave a comment