UpHeron
All vulnerabilities

Servers and applications

CVE-2021-29921

In Python before 3,9,5, the ipaddress library mishandles leading zero characters in the octets of an IP address string. This (in some situations) allows attackers to bypass access control that is based on IP addresses.

Severity
Critical 9.8
Published
6 May 2021
Last changed
8 Oct 2026
Added to UpHeron
21 Oct 2026
Fixed in
3.8.12, 3.9.5
Sources
NVD

Affected software

SoftwareAffected versions
PythonServers and applications · cpe:a:python:python
  • From 3.8.0 before 3.8.12
  • From 3.9.0 before 3.9.5

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2021-29921
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2021-29921