Access-control bypass or denial via malformed prefix lengths

Improper input validation in Net::IP::LPM before 1.12 allows attackers to bypass allow-lists or block all addresses with malformed masks. The add routine passes nondecimal prefix lengths through Perl-to-C conversion, where they become zero or are truncated, inserting an unintended default route into the lookup trie. Exploitation requires an application to pass attacker-controlled prefix data; the poisoned trie then matches every address, opening an allow-list or disabling a deny-list.