owasp-amass/amass · error

failed to parse %s as a CIDR

Error message

failed to parse %s as a CIDR

What it means

Within ParseCIDRs.Set, each comma-separated token is parsed with net.ParseCIDR. A token that is not valid CIDR notation (address plus /prefix length) aborts parsing with this per-token error, distinguishing bad entries from the empty-string case handled elsewhere.

Source

Thrown at internal/afmt/parse.go:171

		if i > 0 {
			builder.WriteRune(',')
		}
		builder.WriteString(ipnet.String())
	}
	return builder.String()
}

// Set implements the flag.Value interface.
func (p *ParseCIDRs) Set(s string) error {
	if s == "" {
		return fmt.Errorf("%s is not a valid CIDR", s)
	}

	cidrs := strings.Split(s, ",")
	for _, cidr := range cidrs {
		_, ipnet, err := net.ParseCIDR(cidr)
		if err != nil {
			return fmt.Errorf("failed to parse %s as a CIDR", cidr)
		}

		*p = append(*p, ipnet)
	}
	return nil
}

func (p *ParseASNs) String() string {
	if p == nil {
		return ""
	}
	var builder strings.Builder
	for i, n := range *p {
		if i > 0 {
			builder.WriteRune(',')
		}
		builder.WriteString(strconv.Itoa(n))
	}

View on GitHub (pinned to 79299dce87)

Solutions

1. Ensure every entry is in x.x.x.x/nn form, e.g. "192.168.1.0/24".
2. Validate locally with net.ParseCIDR (or an equivalent ipaddress library) before passing the flag.
3. Check prefix bounds: 0-32 for IPv4, 0-128 for IPv6.

Example fix

// before
-cidr "192.168.1.1"          # missing prefix -> failed to parse as a CIDR
// after
-cidr "192.168.1.0/24"       # network address with prefix length

func eachTokenIsCIDR(value string) error {
	for _, c := range strings.Split(value, ",") {
		if _, _, err := net.ParseCIDR(strings.TrimSpace(c)); err != nil {
			return fmt.Errorf("%q is not CIDR notation (need address/prefix)", c)
		}
	}
	return nil
}

func isCIDRToken(s string) bool { _, _, err := net.ParseCIDR(s); return err == nil }

When it happens

Trigger: Tokens missing a prefix ("192.168.1.1"), out-of-range prefixes ("10.0.0.0/33"), double slashes ("10.0.0.0/8/8"), or non-numeric garbage in the prefix position.

Common situations: Forgetting the /prefix on a bare IP, typo'd prefix lengths, IPv6/IPv4 prefix confusion, copy-paste artifacts like spaces or trailing commas.

Understand the failure class

Background: "unknown output mode", "invalid value for flag", "expects true/false": fixing invalid flag value errors in CLI tools — this error's family across 24 libraries.

• Parsing and encoding errors: unexpected token, malformed input — why parsers reject input and how to find the real culprit.

Related errors

• %s is not a valid CIDR
• IP address parsing failed
• String parsing failed
• integer parsing failed
• %s is not a valid IP address or range

AI-assisted analysis of owasp-amass/amass@79299dce87 (2026-09-06). Data as JSON: /api/errors/bde61bafd3baec01. Report an issue: GitHub.