Improper input validation in the Perl Net::IP::LPM module allows attackers to bypass allow-lists or deny-lists by poisoning the IP lookup table with malformed prefix lengths.

The library fails to correctly validate prefix lengths, accepting non-numeric or non-ASCII characters as zero and silently truncating integers exceeding 31 bits. This allows an unauthenticated attacker to inject a malformed mask that poisons the lookup table, causing all subsequent address lookups to succeed silently.

This vulnerability creates a critical security failure in network access control logic. By poisoning the lookup table, an attacker can effectively disable security policies, rendering allow-lists or deny-lists entirely ineffective. With a CVSS score of 7.5, the potential for unauthorized network access or the circumvention of critical security controls poses a significant risk to the integrity of the network infrastructure.

Immediate Action: Upgrade to Net::IP::LPM version 1.12 or later to ensure correct input validation for prefix lengths.

Proactive Monitoring: Review access control logs for unexpected traffic patterns that might indicate a failure in IP-based filtering mechanisms.

Compensating Controls: Implement secondary validation layers at the firewall or load balancer level to ensure IP addresses are handled according to intended security policies.

Public Exploit Available: No (exploit_available: false)

The severity of this issue is elevated due to its direct impact on network security enforcement. Administrators should verify if their applications utilize Net::IP::LPM for critical traffic routing or access control and apply the update immediately to restore correct filtering behavior.