diff --git a/net/ip.go b/net/ip.go
index d310f17b98b29f346f5daae6b687db0585f8daf9..1ce30e826fee924841956d47814167e37b88b6f8 100644
--- a/net/ip.go
+++ b/net/ip.go
@@ -210,6 +210,9 @@ func (n Network) Contains(nn NetworkNumber) bool {
 
 // Contains returns true if Network covers o, false otherwise
 func (n Network) Covers(o Network) bool {
+	if len(n.Number) != len(o.Number) {
+		return false
+	}
 	nMaskSize, _ := n.IPNet.Mask.Size()
 	oMaskSize, _ := o.IPNet.Mask.Size()
 	return n.Contains(o.Number) && nMaskSize <= oMaskSize
diff --git a/net/ip_test.go b/net/ip_test.go
index 6a9d2b1b276b1a1cbc3740cc9c86aefa6f8ec57e..78a77742ae1db1c328feb4956f53858c7912ec12 100644
--- a/net/ip_test.go
+++ b/net/ip_test.go
@@ -424,6 +424,8 @@ func TestNetworkCovers(t *testing.T) {
 		{"10.0.0.0/16", "10.0.0.0/15", false, "prefix false"},
 		{"10.0.0.0/15", "10.0.0.0/16", true, "prefix true"},
 		{"10.0.0.0/15", "10.0.0.0/15", true, "same"},
+		{"10::0/15", "10.0.0.0/15", false, "ip version mismatch"},
+		{"10::0/15", "10::0/16", true, "ipv6"},
 	}
 
 	for _, tc := range cases {