Every CVE Search/ Get API key

CVE-2021-29922

library/std/src/net/parser.rs in Rust before 1.53.0 does not properly consider extraneous zero...

9.1 CriticalFix available

library/std/src/net/parser.rs in Rust before 1.53.0 does not properly consider extraneous zero characters at the beginning of an IP address string, which (in some situations) allows attackers to bypass access control that is based on IP addresses, because of unexpected octal interpretation.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
High
Availability
High

Exploit likelihood

2.62%Up 1.4 points since Aug 8, 2021
90%50%10%1%

What each source reports

NVD Score used 9.1

library/std/src/net/parser.rs in Rust before 1.53.0 does not properly consider extraneous zero characters at the beginning of an IP address string, which (in some situations) allows attackers to bypass access control that is based on IP addresses, because of unexpected octal interpretation.

Record
CVE-2021-29922
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
CVSS 2.0
6.4 MediumAV:N/AC:L/Au:N/C:N/I:P/A:P
Updated
2026-11-02
CVE List No score

library/std/src/net/parser.rs in Rust before 1.53.0 does not properly consider extraneous zero characters at the beginning of an IP address string, which (in some situations) allows attackers to bypass access control that is based on IP addresses, because of unexpected octal interpretation.

Record
CVE-2021-29922
Updated
2026-11-02
EUVDEUVD-2021-16396 No score

library/std/src/net/parser.rs in Rust before 1.53.0 does not properly consider extraneous zero characters at the beginning of an IP address string, which (in some situations) allows attackers to bypass access control that is based on IP addresses, because of unexpected octal interpretation.

Record
EUVD-2021-16396
Updated
2026-11-03
GitHub AdvisoriesGHSA-g9v3-gh27-qjh3 9.1

library/std/src/net/parser.rs in Rust before 1.53.0 does not properly consider extraneous zero...

library/std/src/net/parser.rs in Rust before 1.53.0 does not properly consider extraneous zero characters at the beginning of an IP address string, which (in some situations) allows attackers to bypass access control that is based on IP addresses, because of unexpected octal interpretation.

Record
GHSA-g9v3-gh27-qjh3
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Updated
2026-11-02
OSVALPINE-CVE-2021-29922 9.1

library/std/src/net/parser.rs in Rust before 1.53.0 does not properly consider extraneous zero characters at the beginning of an IP address string, which (in some situations) allows attackers to bypass access control that is based on IP addresses, because of unexpected octal interpretation.

Record
ALPINE-CVE-2021-29922
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Updated
2026-11-03
OSVBELL-CVE-2021-29922 9.1

CVE-2021-29922 does not affect BellSoft software

Record
BELL-CVE-2021-29922
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Updated
2026-11-02
Show 7 moreShow less
OSV 9.1

library/std/src/net/parser.rs in Rust before 1.53.0 does not properly consider extraneous zero characters at the beginning of an IP address string, which (in some situations) allows attackers to bypass access control that is based on IP addresses, because of unexpected octal interpretation.

Record
CVE-2021-29922
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2021-29922 9.1

library/std/src/net/parser.rs in Rust before 1.53.0 does not properly consider extraneous zero characters at the beginning of an IP address string, which (in some situations) allows attackers to bypass access control that is based on IP addresses, because of unexpected octal interpretation.

Record
DEBIAN-CVE-2021-29922
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Updated
2026-11-02
OSVOESA-2021-1323 9.1

rust security update

Rust is a systems programming language that runs blazingly fast, prevents segfaults, and guarantees thread safety.

Security Fix(es):

library/std/src/net/parser.rs in Rust before 1.53.0 does not properly consider extraneous zero characters at the beginning of an IP address string, which (in some situations) allows attackers to bypass access control that is based on IP addresses, because of unexpected octal interpretation.(CVE-2021-29922)

Record
OESA-2021-1323
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Updated
2026-11-02
OSVRHSA-2021:4270 7.3

Red Hat Security Advisory: rust-toolset:rhel8 security, bug fix, and enhancement update

Record
RHSA-2021:4270
CVSS 3.1
7.3 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Updated
2026-11-02
OSVRLSA-2021:4270 7.3

Moderate: rust-toolset:rhel8 security, bug fix, and enhancement update

Rust Toolset provides the Rust programming language compiler rustc, the cargo build tool and dependency manager, and required libraries.

The following packages have been upgraded to a later upstream version: rust (1.54.0). (BZ#1945805)

Security Fix(es):

  • rust: incorrect parsing of extraneous zero characters at the beginning of an IP address string (CVE-2021-29922)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 8.5 Release Notes linked from the References section.

Record
RLSA-2021:4270
CVSS 3.1
7.3 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Updated
2026-11-02
OSVUBUNTU-CVE-2021-29922 9.1

library/std/src/net/parser.rs in Rust before 1.53.0 does not properly consider extraneous zero characters at the beginning of an IP address string, which (in some situations) allows attackers to bypass access control that is based on IP addresses, because of unexpected octal interpretation.

Record
UBUNTU-CVE-2021-29922
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Updated
2026-11-02
OSVALSA-2021:4270 No score

Moderate: rust-toolset:rhel8 security, bug fix, and enhancement update

Rust Toolset provides the Rust programming language compiler rustc, the cargo build tool and dependency manager, and required libraries.

The following packages have been upgraded to a later upstream version: rust (1.54.0). (BZ#1945805)

Security Fix(es):

  • rust: incorrect parsing of extraneous zero characters at the beginning of an IP address string (CVE-2021-29922)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

Record
ALSA-2021:4270
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
chromium-rust
Alpine:v3.24
 before 1.52.1-r1
1.52.1-r1
rust
Alpine:v3.14
 before 1.52.1-r1
1.52.1-r1
rust
Alpine:v3.15
 before 1.52.1-r1
1.52.1-r1
rust
Alpine:v3.16
 before 1.52.1-r1
1.52.1-r1
rust
Alpine:v3.17
 before 1.52.1-r1
1.52.1-r1
rust
Alpine:v3.18
 before 1.52.1-r1
1.52.1-r1
rust
Alpine:v3.19
 before 1.52.1-r1
1.52.1-r1
rust
Alpine:v3.20
 before 1.52.1-r1
1.52.1-r1
rust
Alpine:v3.21
 before 1.52.1-r1
1.52.1-r1
rust
Alpine:v3.22
 before 1.52.1-r1
1.52.1-r1
Show 35 moreShow less
Affected packages
PackageAffectedFixed
rust
Alpine:v3.23
 before 1.52.1-r1
1.52.1-r1
rust
Alpine:v3.24
 before 1.52.1-r1
1.52.1-r1
rust-toolset
AlmaLinux:8
 before 1.54.0-1.module_el8.5.0+2599+d655d86c
1.54.0-1.module_el8.5.0+2599+d655d86c
rustc
Debian:12
 before 1.53.0+dfsg1-1
1.53.0+dfsg1-1
rustc
Debian:13
 before 1.53.0+dfsg1-1
1.53.0+dfsg1-1
rustc
Debian:14
 before 1.53.0+dfsg1-1
1.53.0+dfsg1-1
rust
openEuler:20.03-LTS-SP1
 before 1.51.0-5.oe1
1.51.0-5.oe1
rust
openEuler:20.03-LTS-SP2
 before 1.51.0-5.oe1
1.51.0-5.oe1
cargo
Red Hat:enterprise_linux:8::appstream
 before 0:1.54.0-2.module+el8.5.0+12254+dc27bae9
0:1.54.0-2.module+el8.5.0+12254+dc27bae9
cargo-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 0:1.54.0-2.module+el8.5.0+12254+dc27bae9
0:1.54.0-2.module+el8.5.0+12254+dc27bae9
cargo-doc
Red Hat:enterprise_linux:8::appstream
 before 0:1.54.0-2.module+el8.5.0+12254+dc27bae9
0:1.54.0-2.module+el8.5.0+12254+dc27bae9
clippy
Red Hat:enterprise_linux:8::appstream
 before 0:1.54.0-2.module+el8.5.0+12254+dc27bae9
0:1.54.0-2.module+el8.5.0+12254+dc27bae9
clippy-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 0:1.54.0-2.module+el8.5.0+12254+dc27bae9
0:1.54.0-2.module+el8.5.0+12254+dc27bae9
rls
Red Hat:enterprise_linux:8::appstream
 before 0:1.54.0-2.module+el8.5.0+12254+dc27bae9
0:1.54.0-2.module+el8.5.0+12254+dc27bae9
rls-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 0:1.54.0-2.module+el8.5.0+12254+dc27bae9
0:1.54.0-2.module+el8.5.0+12254+dc27bae9
rust
Red Hat:enterprise_linux:8::appstream
 before 0:1.54.0-2.module+el8.5.0+12254+dc27bae9
0:1.54.0-2.module+el8.5.0+12254+dc27bae9
rust-analysis
Red Hat:enterprise_linux:8::appstream
 before 0:1.54.0-2.module+el8.5.0+12254+dc27bae9
0:1.54.0-2.module+el8.5.0+12254+dc27bae9
rust-debugger-common
Red Hat:enterprise_linux:8::appstream
 before 0:1.54.0-2.module+el8.5.0+12254+dc27bae9
0:1.54.0-2.module+el8.5.0+12254+dc27bae9
rust-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 0:1.54.0-2.module+el8.5.0+12254+dc27bae9
0:1.54.0-2.module+el8.5.0+12254+dc27bae9
rust-debugsource
Red Hat:enterprise_linux:8::appstream
 before 0:1.54.0-2.module+el8.5.0+12254+dc27bae9
0:1.54.0-2.module+el8.5.0+12254+dc27bae9
rust-doc
Red Hat:enterprise_linux:8::appstream
 before 0:1.54.0-2.module+el8.5.0+12254+dc27bae9
0:1.54.0-2.module+el8.5.0+12254+dc27bae9
rust-gdb
Red Hat:enterprise_linux:8::appstream
 before 0:1.54.0-2.module+el8.5.0+12254+dc27bae9
0:1.54.0-2.module+el8.5.0+12254+dc27bae9
rust-lldb
Red Hat:enterprise_linux:8::appstream
 before 0:1.54.0-2.module+el8.5.0+12254+dc27bae9
0:1.54.0-2.module+el8.5.0+12254+dc27bae9
rust-src
Red Hat:enterprise_linux:8::appstream
 before 0:1.54.0-2.module+el8.5.0+12254+dc27bae9
0:1.54.0-2.module+el8.5.0+12254+dc27bae9
rust-std-static
Red Hat:enterprise_linux:8::appstream
 before 0:1.54.0-2.module+el8.5.0+12254+dc27bae9
0:1.54.0-2.module+el8.5.0+12254+dc27bae9
rust-std-static-wasm32-unknown-unknown
Red Hat:enterprise_linux:8::appstream
 before 0:1.54.0-2.module+el8.5.0+12254+dc27bae9
0:1.54.0-2.module+el8.5.0+12254+dc27bae9
rust-toolset
Red Hat:enterprise_linux:8::appstream
 before 0:1.54.0-1.module+el8.5.0+12195+effd8a03
0:1.54.0-1.module+el8.5.0+12195+effd8a03
rustfmt
Red Hat:enterprise_linux:8::appstream
 before 0:1.54.0-2.module+el8.5.0+12254+dc27bae9
0:1.54.0-2.module+el8.5.0+12254+dc27bae9
rustfmt-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 0:1.54.0-2.module+el8.5.0+12254+dc27bae9
0:1.54.0-2.module+el8.5.0+12254+dc27bae9
rust
Rocky Linux:8
 before 0:1.54.0-2.module+el8.5.0+678+cf7bc64b
0:1.54.0-2.module+el8.5.0+678+cf7bc64b
rust-toolset
Rocky Linux:8
 before 0:1.54.0-1.module+el8.5.0+678+cf7bc64b
0:1.54.0-1.module+el8.5.0+678+cf7bc64b
rustc
Ubuntu:Pro:14.04:LTS
 All versions, plus listed versions
1.15.1+dfsg0-1~exp1ubuntu2~14.04.71.17.0+dfsg2-8~ubuntu0.14.04.31.21.0+dfsg1+llvm-0ubuntu3~14.04.51.22.1+dfsg1+llvm-0ubuntu2~14.04.21.24.1+dfsg1+llvm-0ubuntu1~14.04.1
Show 5 moreShow less
1.25.0+dfsg1+llvm-0ubuntu1~14.04.11.28.0+dfsg1+llvm-0ubuntu1~14.04.11.30.0+dfsg1+llvm-2ubuntu1~14.04.11.31.0+dfsg1+llvm-2ubuntu1~14.04.11.31.0+dfsg1+llvm-2ubuntu1~14.04.1ubuntu1
 None known
rustc
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
1.7.0+dfsg1-11.15.1+dfsg0-1~exp1ubuntu2~16.04.31.17.0+dfsg2-8~ubuntu0.16.04.21.21.0+dfsg1+llvm-0ubuntu3~16.04.11.22.1+dfsg1+llvm-0ubuntu2~16.04.2
Show 15 moreShow less
1.24.1+dfsg1+llvm-0ubuntu1~16.04.11.25.0+dfsg1+llvm-0ubuntu1~16.04.11.28.0+dfsg1+llvm-0ubuntu1~16.04.11.30.0+dfsg1+llvm-2ubuntu1~16.04.11.31.0+dfsg1+llvm-2ubuntu1~16.04.11.32.0+dfsg1+llvm-1ubuntu1~16.04.11.34.1+dfsg2+llvm-0ubuntu1~16.04.11.35.0+dfsg0.1+llvm-0ubuntu1~16.04.11.36.0+dfsg1+llvm-2ubuntu1~16.04.11.37.0+dfsg1+llvm-1ubuntu1~16.04.11.39.0+dfsg1+llvm-3ubuntu1~16.04.11.41.0+dfsg1+llvm-0ubuntu1~16.04.11.43.0+dfsg1+llvm-1~exp1ubuntu2~16.04.11.47.0+dfsg1+llvm-1ubuntu1~16.04.11.47.0+dfsg1+llvm-1ubuntu1~16.04.1ubuntu2
 None known
rustc
Ubuntu:20.04:LTS
 before 1.53.0+dfsg1+llvm-4ubuntu1~20.04.1, plus listed versions
1.37.0+dfsg1+llvm-1ubuntu11.38.0+dfsg0.2+llvm-0ubuntu11.38.0+dfsg0.2+llvm-0ubuntu21.39.0+dfsg1+llvm-3ubuntu11.40.0+dfsg1+llvm-5ubuntu1
Show 5 moreShow less
1.41.0+dfsg1+llvm-0ubuntu11.41.0+dfsg1+llvm-0ubuntu21.43.0+dfsg1+llvm-1~exp1ubuntu1~20.04.11.47.0+dfsg1+llvm-1ubuntu1~20.04.11.51.0+dfsg1+llvm-1~exp3ubuntu1~20.04.2
1.53.0+dfsg1+llvm-4ubuntu1~20.04.1
rustc
Ubuntu:22.04:LTS
 before 1.53.0+dfsg1+llvm-4ubuntu1, plus listed versions
1.51.0+dfsg1+llvm-1~exp3ubuntu1
1.53.0+dfsg1+llvm-4ubuntu1

History

History
RecordedChangedSources
affectedOSV
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2021-29922 is a critical vulnerability (CVSS 9.1) in Rust-lang Rust, published August 7, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.62%, the 85th percentile. Fixed in chromium-rust 1.52.1-r1.

References

Show 16 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open