CVE-2021-29424
The Net::Netmask module before 2.0000 for Perl does not properly consider extraneous zero...
The Net::Netmask module before 2.0000 for Perl does not properly consider extraneous zero characters at the beginning of an IP address string, which (in some situations) allows attackers to bypass access control that is based on IP addresses.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
The Net::Netmask module before 2.0000 for Perl does not properly consider extraneous zero characters at the beginning of an IP address string, which (in some situations) allows attackers to bypass access control that is based on IP addresses.
- Record
CVE-2021-29424- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:P/A:N - Weakness
- CWE-704
- Updated
- 2026-11-02
CVE List No score
The Net::Netmask module before 2.0000 for Perl does not properly consider extraneous zero characters at the beginning of an IP address string, which (in some situations) allows attackers to bypass access control that is based on IP addresses.
- Record
CVE-2021-29424- Updated
- 2026-11-02
EUVDEUVD-2021-16056 No score
The Net::Netmask module before 2.0000 for Perl does not properly consider extraneous zero characters at the beginning of an IP address string, which (in some situations) allows attackers to bypass access control that is based on IP addresses.
- Record
EUVD-2021-16056- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-p75p-x3j9-7vj3
The Net::Netmask module before 2.0000 for Perl does not properly consider extraneous zero...
The Net::Netmask module before 2.0000 for Perl does not properly consider extraneous zero characters at the beginning of an IP address string, which (in some situations) allows attackers to bypass access control that is based on IP addresses.
- Record
GHSA-p75p-x3j9-7vj3- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-863
- Updated
- 2026-11-02
OSVALPINE-CVE-2021-29424
The Net::Netmask module before 2.0000 for Perl does not properly consider extraneous zero characters at the beginning of an IP address string, which (in some situations) allows attackers to bypass access control that is based on IP addresses.
- Record
ALPINE-CVE-2021-29424- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-03
OSV
The Net::Netmask module before 2.0000 for Perl does not properly consider extraneous zero characters at the beginning of an IP address string, which (in some situations) allows attackers to bypass access control that is based on IP addresses.
- Record
CVE-2021-29424- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
Show 5 moreShow less
OSVDEBIAN-CVE-2021-29424
The Net::Netmask module before 2.0000 for Perl does not properly consider extraneous zero characters at the beginning of an IP address string, which (in some situations) allows attackers to bypass access control that is based on IP addresses.
- Record
DEBIAN-CVE-2021-29424- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2021-29424
The Net::Netmask module before 2.0000 for Perl does not properly consider extraneous zero characters at the beginning of an IP address string, which (in some situations) allows attackers to bypass access control that is based on IP addresses.
- Record
UBUNTU-CVE-2021-29424- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSVMGASA-2021-0375 No score
Updated perl-Net-Netmask package fixes a security vulnerability
The Net::Netmask module before 2.0000 for Perl does not properly consider extraneous zero characters at the beginning of an IP address string, which (in some situations) allows attackers to bypass access control that is based on IP addresses (CVE-2021-29424).
- Record
MGASA-2021-0375- Updated
- 2026-11-02
OSVopenSUSE-SU-2023:0215-1 No score
Security update for perl-Net-Netmask
This update for perl-Net-Netmask fixes the following issues:
- CVE-2021-29424: Leading zeros are no longer allowed for IPv4 octets. This (in some situations) allows attackers to bypass access control that is based on IP addresses.(boo#1184425)
- Record
openSUSE-SU-2023:0215-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2023:0217-1 No score
Security update for perl-Net-Netmask
This update for perl-Net-Netmask fixes the following issues:
- CVE-2021-29424: Leading zeros are no longer allowed for IPv4 octets. This (in some situations) allows attackers to bypass access control that is based on IP addresses. (boo#1184425)
- Record
openSUSE-SU-2023:0217-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
perl-net-netmaskAlpine:v3.24 |
before 2.0000-r0 | 2.0000-r0 |
libnet-netmask-perlDebian:12 |
before 1.9104-2 | 1.9104-2 |
libnet-netmask-perlDebian:13 |
before 1.9104-2 | 1.9104-2 |
libnet-netmask-perlDebian:14 |
before 1.9104-2 | 1.9104-2 |
perl-Net-NetmaskMageia:8 |
before 2.0.100-1.mga8 | 2.0.100-1.mga8 |
libnet-netmask-perlUbuntu:16.04:LTS |
All versions, plus listed versions 1.9021-11.9022-1 |
None known |
libnetwork-ipv4addr-perlUbuntu:16.04:LTS |
All versions, plus listed versions 0.10.ds-2 |
None known |
libnet-netmask-perlUbuntu:18.04:LTS |
All versions, plus listed versions 1.9022-1 |
None known |
libnetwork-ipv4addr-perlUbuntu:18.04:LTS |
All versions, plus listed versions 0.10.ds-2 |
None known |
libnet-netmask-perlUbuntu:20.04:LTS |
All versions, plus listed versions 1.9104-1 |
None known |
Show 10 moreShow less
| Package | Affected | Fixed |
|---|---|---|
libnetwork-ipv4addr-perlUbuntu:20.04:LTS |
All versions, plus listed versions 0.10.ds-3 |
None known |
libnetwork-ipv4addr-perlUbuntu:22.04:LTS |
All versions, plus listed versions 0.10.ds-3.1 |
None known |
libnetwork-ipv4addr-perlUbuntu:24.04:LTS |
All versions, plus listed versions 0.10.ds-4 |
None known |
libnetwork-ipv4addr-perlUbuntu:25.10 |
All versions, plus listed versions 0.10.ds-4 |
None known |
libnetwork-ipv4addr-perlUbuntu:26.10 |
All versions, plus listed versions 0.10.ds-4 |
None known |
libnetwork-ipv4addr-perlUbuntu:26.04:LTS |
All versions, plus listed versions 0.10.ds-4 |
None known |
perl-Net-NetmaskSUSE:Package Hub 15 SP4 |
before 1.9022-bp154.2.3.1 | 1.9022-bp154.2.3.1 |
perl-Net-NetmaskopenSUSE:Leap 15.4 |
before 1.9022-bp154.2.3.1 | 1.9022-bp154.2.3.1 |
perl-Net-NetmaskSUSE:Package Hub 15 SP5 |
before 1.9022-bp155.3.3.1 | 1.9022-bp155.3.3.1 |
perl-Net-NetmaskopenSUSE:Leap 15.5 |
before 1.9022-bp155.3.3.1 | 1.9022-bp155.3.3.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, aliases, references | OSV | |
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-29424 is a high vulnerability (CVSS 7.5) in Fedoraproject Fedora, published March 29, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.80%, the 78th percentile. Fixed in perl-net-netmask 2.0000-r0.
References
blog.urth.org/2021/03/29/security-issues-in-perl-ip-address-distros
metacpan.org/changes/distribution/Net-Netmask
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CBJVLXJSWN6DKSF5ADUEERI6M23R3GGP
security.netapp.com/advisory/ntap-20210604-0007
Show 16 moreShow less
nvd.nist.gov/vuln/detail/CVE-2021-29424
github.com/advisories/GHSA-p75p-x3j9-7vj3
security.alpinelinux.org/vuln/CVE-2021-29424
security-tracker.debian.org/tracker/CVE-2021-29424
advisories.mageia.org/MGASA-2021-0375.html
bugs.mageia.org/show_bug.cgi?id=29023
ubuntu.com/security/CVE-2021-29424
cve.org/CVERecord?id=CVE-2021-29424
lists.opensuse.org/archives/list/[email protected]/thread/7UYESPZ25JO4DP7GV5KTIH3W7NKCQ62I
bugzilla.suse.com/1184425
suse.com/security/cve/CVE-2021-29424