diff --git a/CHANGELOG b/CHANGELOG
index b9ca3e12a..495523b74 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -1,5 +1,9 @@
 #Nmap Changelog ($Id$); -*-text-*-
 
+o [GH#3565][GH#3573] Fixed an issue with addrset: When a CIDR spec was added
+  after a narrower one, its prefix exactly the common prefix of the two, the
+  addrset trie did not cover the whole broader range. [Dennys Kaluzny Pereira]
+
 Nmap 7.993 [2026-10-23]
 
 o [NSE][GH#3557] Fixed a regression which prevented most scripts in the version
diff --git a/nbase/nbase_addrset.c b/nbase/nbase_addrset.c
index 42c830aa3..35a4ba41f 100644
--- a/nbase/nbase_addrset.c
+++ b/nbase/nbase_addrset.c
@@ -331,8 +331,11 @@ static void trie_split (struct trie_node *this, const u32 *addr, const u32 *mask
       /* Addrs have more bits in common than we care about for this node. */
       new_mask[i] = this->mask[i];
     }
-    if (new_mask[i] > mask[i]) {
-      /* new addr's mask is broader, so this node is superseded. */
+    if (new_mask[i] > mask[i]
+        || (new_mask[i] == mask[i] && mask[i] != U32_ALL_BITS)) {
+      /* new addr's mask is no longer than the common prefix, so this node is
+       * superseded. Equal full words don't count: the new mask continues in
+       * the next word, so keep comparing. */
       this->mask[i] = mask[i];
       for (i++; i < 4; i++) {
         this->mask[i] = 0;
diff --git a/ncat/test/test-addrset.sh b/ncat/test/test-addrset.sh
index 4295188f5..bacde12c3 100755
--- a/ncat/test/test-addrset.sh
+++ b/ncat/test/test-addrset.sh
@@ -181,6 +181,43 @@ test_addrset "192.168.0.0/24" "192.168.0.5 192.168.0.90" <<EOF
 1.2.3.4
 EOF
 
+# Overlapping CIDR netmasks: order must not matter.
+test_addrset "10.200.0.0/16 10.0.0.0/8" "10.150.0.20 10.200.1.1 10.0.0.1" <<EOF
+10.150.0.20
+10.200.1.1
+10.0.0.1
+11.0.0.1
+EOF
+
+test_addrset "10.0.0.0/8 10.200.0.0/16" "10.150.0.20 10.200.1.1 10.0.0.1" <<EOF
+10.150.0.20
+10.200.1.1
+10.0.0.1
+11.0.0.1
+EOF
+
+test_addrset "10.200.0.0/16 10.0.0.0/16 10.0.0.0/8" "10.150.0.20 10.200.1.1 10.0.0.1" <<EOF
+10.150.0.20
+10.200.1.1
+10.0.0.1
+11.0.0.1
+EOF
+
+# A broader IPv4 /0 after a narrower spec.
+test_addrset "200.0.0.0/16 0.0.0.0/0" "200.1.1.1 200.0.0.1 1.2.3.4" <<EOF
+200.1.1.1
+200.0.0.1
+1.2.3.4
+EOF
+
+# Overlapping IPv6 netmasks, with the broader mask on a 32-bit boundary.
+test_addrset "1:2:8000::/48 1:2::/32" "1:2::1 1:2:8000::1 1:2:c000::1" <<EOF
+1:2::1
+1:2:8000::1
+1:2:c000::1
+1:3::1
+EOF
+
 # /32 netmask.
 test_addrset "1.2.3.4/32" "1.2.3.4" <<EOF
 192.168.0.10