The Net::CIDR::Set module for Perl is susceptible to remote denial of service attacks due to improper validation of input lengths, which can lead to severe memory exhaustion.

This vulnerability involves improper validation of specified quantity in input (CWE-1284) and memory allocation with excessive size values (CWE-789). An unauthenticated attacker can trigger this by passing an oversized IPv6 prefix length to the contains or add methods, forcing the application to allocate massive amounts of memory and potentially crashing the process.

The exploitation of this vulnerability results in a denial of service for any application utilizing the Net::CIDR::Set module to process network data. Given the CVSS score of 7.5, which classifies this as a High severity issue, the risk to service availability is significant. Organizations relying on this library for firewall rules, IP filtering, or network management may face service outages if an attacker deliberately sends malformed CIDR inputs to the application.

Immediate Action: Update the Net::CIDR::Set module to version 0.23 or later, which includes the necessary input validation checks to prevent excessive memory allocation.

Proactive Monitoring: Monitor application logs and system resource usage for unexpected spikes in memory consumption or process crashes following the processing of incoming network-related requests.

Compensating Controls: Implement input length validation at the application boundary to reject malformed or excessively long CIDR strings before they reach the Net::CIDR::Set processing logic.

Public Exploit Available: No — there is no confirmed public exploit in the available data.

This vulnerability presents a clear risk to system stability for any service using the affected Perl module to parse network ranges. Administrators should prioritize the update to version 0.23 immediately to remediate the underlying logic error. If an immediate update is not feasible, ensure that any user-supplied network input is strictly validated for length and format before being passed to library methods.