CVE-2021-29921
criticalIn Python before 3,9,5, the ipaddress library mishandles leading zero characters in the octets of an IP address string.
Vendor / product: Python — python
In Python before 3,9,5, the ipaddress library mishandles leading zero characters in the octets of an IP address string. This (in some situations) allows attackers to bypass access control that is based on IP addresses.
CVSS
9.8
9.8 (CVSS v3.1)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Severity source: NVD CVSS v3.1 (nvd@nist.gov)
Timeline (UTC)
Published: 2021-05-06 13:15
Modified: 2026-10-08 22:17
NVD status: Modified
Last synced 2 days ago
Verified against the source API 2026-10-27 07:06 UTC
Exploitation
Not listed in CISA KEV (as of last catalog sync)
Absence from KEV does not mean a CVE is not exploited. Exploitation status: unknown (no authoritative evidence in our sources).
Affected products
python / python ≥3.8.0 <3.8.12, ≥3.9.0 <3.9.5
oracle / communications_cloud_native_core_automated_test_suite 1.8.0
oracle / communications_cloud_native_core_binding_support_function 1.11.0
oracle / communications_cloud_native_core_network_slice_selection_function 1.8.0
oracle / graalvm 20.3.2, 21.1.0
oracle / zfs_storage_appliance_kit 8.8
Weakness classification (CWE)
NVD-CWE-Other
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
Vendor advisory: https://bugs.python.org/issue36384
Vendor advisory: https://docs.python.org/3/library/ipaddress.html
Vendor advisory: https://bugs.python.org/issue36384
Vendor advisory: https://docs.python.org/3/library/ipaddress.html
Patch / mitigation: https://bugs.python.org/issue36384
Patch / mitigation: https://github.com/python/cpython/pull/12577
Patch / mitigation: https://github.com/python/cpython/pull/25099
Patch / mitigation: https://www.oracle.com//security-alerts/cpujul2021.html
Patch / mitigation: https://www.oracle.com/security-alerts/cpuapr2022.html
Patch / mitigation: https://www.oracle.com/security-alerts/cpujan2022.html
Patch / mitigation: https://www.oracle.com/security-alerts/cpuoct2021.html
Patch / mitigation: https://bugs.python.org/issue36384
Patch / mitigation: https://github.com/python/cpython/pull/12577
Patch / mitigation: https://github.com/python/cpython/pull/25099
References
- https://bugs.python.org/issue36384 cve@mitre.org
- https://docs.python.org/3/library/ipaddress.html cve@mitre.org
- https://github.com/python/cpython/blob/63298930fb531ba2bb4f23bc3b915dbf1e17e9e1/Misc/NEWS.... cve@mitre.org
- https://github.com/python/cpython/pull/12577 cve@mitre.org
- https://github.com/python/cpython/pull/25099 cve@mitre.org
- https://github.com/sickcodes cve@mitre.org
- https://github.com/sickcodes/security/blob/master/advisories/SICK-2021-014.md cve@mitre.org
- https://python-security.readthedocs.io/vuln/ipaddress-ipv4-leading-zeros.html cve@mitre.org
- https://security.gentoo.org/glsa/202305-02 cve@mitre.org
- https://security.netapp.com/advisory/ntap-20210622-0003/ cve@mitre.org
- https://sick.codes/sick-2021-014 cve@mitre.org
- https://www.oracle.com//security-alerts/cpujul2021.html cve@mitre.org
- https://www.oracle.com/security-alerts/cpuapr2022.html cve@mitre.org
- https://www.oracle.com/security-alerts/cpujan2022.html cve@mitre.org
- https://www.oracle.com/security-alerts/cpujul2022.html cve@mitre.org
- https://www.oracle.com/security-alerts/cpuoct2021.html cve@mitre.org
- https://bugs.python.org/issue36384 af854a3a-2127-422b-91ae-364da2661108
- https://docs.python.org/3/library/ipaddress.html af854a3a-2127-422b-91ae-364da2661108
- https://github.com/python/cpython/blob/63298930fb531ba2bb4f23bc3b915dbf1e17e9e1/Misc/NEWS.... af854a3a-2127-422b-91ae-364da2661108
- https://github.com/python/cpython/pull/12577 af854a3a-2127-422b-91ae-364da2661108
- https://github.com/python/cpython/pull/25099 af854a3a-2127-422b-91ae-364da2661108
- https://github.com/sickcodes af854a3a-2127-422b-91ae-364da2661108
- https://github.com/sickcodes/security/blob/master/advisories/SICK-2021-014.md af854a3a-2127-422b-91ae-364da2661108
- https://lists.debian.org/debian-lts-announce/2024/12/msg00000.html af854a3a-2127-422b-91ae-364da2661108
- https://python-security.readthedocs.io/vuln/ipaddress-ipv4-leading-zeros.html af854a3a-2127-422b-91ae-364da2661108
Data sources
NVD CVE API 2.0 — fetched 2026-10-27 07:06 UTC · record ↗