{"action":"Upgrade libnet-cidr-set-perl to 0.15-1 or later.","affected":[{"fixed":"0.15-1","introduced":"0"}],"component":"libnet-cidr-set-perl","cve_ids":[],"ecosystem":"Debian","ecosystem_qualifier":"Debian:13","exploited":false,"fixed_versions":["0.15-1"],"id":"tcs_01M5NNVQB6AY2JBWMQC9NR3Y4J","modified_at":"2026-09-01T20:05:52.650860032Z","published_at":"2025-05-27T22:15:22.337Z","references":["https://osv.dev/vulnerability/DEBIAN-CVE-2025-40911","https://security-tracker.debian.org/tracker/CVE-2025-40911"],"severity":{"label":"medium","score":6.5},"sources":[{"source":"osv","source_id":"DEBIAN-CVE-2025-40911#Debian:13/libnet-cidr-set-perl","url":"https://osv.dev/vulnerability/DEBIAN-CVE-2025-40911"}],"summary":"Net::CIDR::Set versions 0.10 through 0.13 for Perl does not properly handle leading zero characters in IP CIDR address strings, which could allow attackers to bypass access control that is based on IP"}