{"id":"CVE-2021-29922","aliases":["ALPINE-CVE-2021-29922","ALSA-2021:4270","BELL-CVE-2021-29922","DEBIAN-CVE-2021-29922","EUVD-2021-16396","GHSA-g9v3-gh27-qjh3","OESA-2021-1323","RHSA-2021:4270","RLSA-2021:4270","UBUNTU-CVE-2021-29922"],"status":"published","title":"library/std/src/net/parser.rs in Rust before 1.53.0 does not properly consider extraneous zero...","description":"library/std/src/net/parser.rs in Rust before 1.53.0 does not properly consider extraneous zero characters at the beginning of an IP address string, which (in some situations) allows attackers to bypass access control that is based on IP addresses, because of unexpected octal interpretation.","severity":{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.02452,"percentile":0.84522,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2021-08-07T00:00:00Z","modified":"2026-11-03T06:32:39Z","fixes":[{"ecosystem":"Alpine:v3.24","package":"chromium-rust","fixed_in":["1.52.1-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"rust","fixed_in":["1.52.1-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"rust","fixed_in":["1.52.1-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"rust","fixed_in":["1.52.1-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"rust","fixed_in":["1.52.1-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"rust","fixed_in":["1.52.1-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"rust","fixed_in":["1.52.1-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"rust","fixed_in":["1.52.1-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"rust","fixed_in":["1.52.1-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"rust","fixed_in":["1.52.1-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"rust","fixed_in":["1.52.1-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"rust","fixed_in":["1.52.1-r1"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"rust-toolset","fixed_in":["1.54.0-1.module_el8.5.0+2599+d655d86c"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"rustc","fixed_in":["1.53.0+dfsg1-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"rustc","fixed_in":["1.53.0+dfsg1-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"rustc","fixed_in":["1.53.0+dfsg1-1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP1","package":"rust","fixed_in":["1.51.0-5.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP2","package":"rust","fixed_in":["1.51.0-5.oe1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"cargo","fixed_in":["0:1.54.0-2.module+el8.5.0+12254+dc27bae9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"cargo-debuginfo","fixed_in":["0:1.54.0-2.module+el8.5.0+12254+dc27bae9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"cargo-doc","fixed_in":["0:1.54.0-2.module+el8.5.0+12254+dc27bae9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"clippy","fixed_in":["0:1.54.0-2.module+el8.5.0+12254+dc27bae9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"clippy-debuginfo","fixed_in":["0:1.54.0-2.module+el8.5.0+12254+dc27bae9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"rls","fixed_in":["0:1.54.0-2.module+el8.5.0+12254+dc27bae9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"rls-debuginfo","fixed_in":["0:1.54.0-2.module+el8.5.0+12254+dc27bae9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"rust","fixed_in":["0:1.54.0-2.module+el8.5.0+12254+dc27bae9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"rust-analysis","fixed_in":["0:1.54.0-2.module+el8.5.0+12254+dc27bae9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"rust-debugger-common","fixed_in":["0:1.54.0-2.module+el8.5.0+12254+dc27bae9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"rust-debuginfo","fixed_in":["0:1.54.0-2.module+el8.5.0+12254+dc27bae9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"rust-debugsource","fixed_in":["0:1.54.0-2.module+el8.5.0+12254+dc27bae9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"rust-doc","fixed_in":["0:1.54.0-2.module+el8.5.0+12254+dc27bae9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"rust-gdb","fixed_in":["0:1.54.0-2.module+el8.5.0+12254+dc27bae9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"rust-lldb","fixed_in":["0:1.54.0-2.module+el8.5.0+12254+dc27bae9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"rust-src","fixed_in":["0:1.54.0-2.module+el8.5.0+12254+dc27bae9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"rust-std-static","fixed_in":["0:1.54.0-2.module+el8.5.0+12254+dc27bae9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"rust-std-static-wasm32-unknown-unknown","fixed_in":["0:1.54.0-2.module+el8.5.0+12254+dc27bae9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"rust-toolset","fixed_in":["0:1.54.0-1.module+el8.5.0+12195+effd8a03"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"rustfmt","fixed_in":["0:1.54.0-2.module+el8.5.0+12254+dc27bae9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"rustfmt-debuginfo","fixed_in":["0:1.54.0-2.module+el8.5.0+12254+dc27bae9"],"sources":["osv"]},{"ecosystem":"Rocky Linux:8","package":"rust","fixed_in":["0:1.54.0-2.module+el8.5.0+678+cf7bc64b"],"sources":["osv"]},{"ecosystem":"Rocky Linux:8","package":"rust-toolset","fixed_in":["0:1.54.0-1.module+el8.5.0+678+cf7bc64b"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"rustc","fixed_in":["1.53.0+dfsg1+llvm-4ubuntu1~20.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"rustc","fixed_in":["1.53.0+dfsg1+llvm-4ubuntu1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.24","package":"chromium-rust","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.52.1-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"rust","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.52.1-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"rust","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.52.1-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"rust","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.52.1-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"rust","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.52.1-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"rust","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.52.1-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"rust","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.52.1-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"rust","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.52.1-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"rust","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.52.1-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"rust","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.52.1-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"rust","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.52.1-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"rust","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.52.1-r1"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"rust-toolset","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.54.0-1.module_el8.5.0+2599+d655d86c"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"rustc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.53.0+dfsg1-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"rustc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.53.0+dfsg1-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"rustc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.53.0+dfsg1-1"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"rust","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.51.0-5.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP2","package":"rust","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.51.0-5.oe1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"cargo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.54.0-2.module+el8.5.0+12254+dc27bae9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"cargo-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.54.0-2.module+el8.5.0+12254+dc27bae9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"cargo-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.54.0-2.module+el8.5.0+12254+dc27bae9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"clippy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.54.0-2.module+el8.5.0+12254+dc27bae9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"clippy-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.54.0-2.module+el8.5.0+12254+dc27bae9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"rls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.54.0-2.module+el8.5.0+12254+dc27bae9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"rls-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.54.0-2.module+el8.5.0+12254+dc27bae9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"rust","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.54.0-2.module+el8.5.0+12254+dc27bae9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"rust-analysis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.54.0-2.module+el8.5.0+12254+dc27bae9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"rust-debugger-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.54.0-2.module+el8.5.0+12254+dc27bae9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"rust-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.54.0-2.module+el8.5.0+12254+dc27bae9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"rust-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.54.0-2.module+el8.5.0+12254+dc27bae9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"rust-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.54.0-2.module+el8.5.0+12254+dc27bae9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"rust-gdb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.54.0-2.module+el8.5.0+12254+dc27bae9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"rust-lldb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.54.0-2.module+el8.5.0+12254+dc27bae9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"rust-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.54.0-2.module+el8.5.0+12254+dc27bae9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"rust-std-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.54.0-2.module+el8.5.0+12254+dc27bae9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"rust-std-static-wasm32-unknown-unknown","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.54.0-2.module+el8.5.0+12254+dc27bae9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"rust-toolset","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.54.0-1.module+el8.5.0+12195+effd8a03"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"rustfmt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.54.0-2.module+el8.5.0+12254+dc27bae9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"rustfmt-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.54.0-2.module+el8.5.0+12254+dc27bae9"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"rust","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.54.0-2.module+el8.5.0+678+cf7bc64b"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"rust-toolset","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.54.0-1.module+el8.5.0+678+cf7bc64b"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"rustc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.15.1+dfsg0-1~exp1ubuntu2~14.04.7","1.17.0+dfsg2-8~ubuntu0.14.04.3","1.21.0+dfsg1+llvm-0ubuntu3~14.04.5","1.22.1+dfsg1+llvm-0ubuntu2~14.04.2","1.24.1+dfsg1+llvm-0ubuntu1~14.04.1","1.25.0+dfsg1+llvm-0ubuntu1~14.04.1","1.28.0+dfsg1+llvm-0ubuntu1~14.04.1","1.30.0+dfsg1+llvm-2ubuntu1~14.04.1","1.31.0+dfsg1+llvm-2ubuntu1~14.04.1","1.31.0+dfsg1+llvm-2ubuntu1~14.04.1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"rustc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.7.0+dfsg1-1","1.15.1+dfsg0-1~exp1ubuntu2~16.04.3","1.17.0+dfsg2-8~ubuntu0.16.04.2","1.21.0+dfsg1+llvm-0ubuntu3~16.04.1","1.22.1+dfsg1+llvm-0ubuntu2~16.04.2","1.24.1+dfsg1+llvm-0ubuntu1~16.04.1","1.25.0+dfsg1+llvm-0ubuntu1~16.04.1","1.28.0+dfsg1+llvm-0ubuntu1~16.04.1","1.30.0+dfsg1+llvm-2ubuntu1~16.04.1","1.31.0+dfsg1+llvm-2ubuntu1~16.04.1","1.32.0+dfsg1+llvm-1ubuntu1~16.04.1","1.34.1+dfsg2+llvm-0ubuntu1~16.04.1","1.35.0+dfsg0.1+llvm-0ubuntu1~16.04.1","1.36.0+dfsg1+llvm-2ubuntu1~16.04.1","1.37.0+dfsg1+llvm-1ubuntu1~16.04.1","1.39.0+dfsg1+llvm-3ubuntu1~16.04.1","1.41.0+dfsg1+llvm-0ubuntu1~16.04.1","1.43.0+dfsg1+llvm-1~exp1ubuntu2~16.04.1","1.47.0+dfsg1+llvm-1ubuntu1~16.04.1","1.47.0+dfsg1+llvm-1ubuntu1~16.04.1ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"rustc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.53.0+dfsg1+llvm-4ubuntu1~20.04.1"}]}],"versions":["1.37.0+dfsg1+llvm-1ubuntu1","1.38.0+dfsg0.2+llvm-0ubuntu1","1.38.0+dfsg0.2+llvm-0ubuntu2","1.39.0+dfsg1+llvm-3ubuntu1","1.40.0+dfsg1+llvm-5ubuntu1","1.41.0+dfsg1+llvm-0ubuntu1","1.41.0+dfsg1+llvm-0ubuntu2","1.43.0+dfsg1+llvm-1~exp1ubuntu1~20.04.1","1.47.0+dfsg1+llvm-1ubuntu1~20.04.1","1.51.0+dfsg1+llvm-1~exp3ubuntu1~20.04.2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"rustc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.53.0+dfsg1+llvm-4ubuntu1"}]}],"versions":["1.51.0+dfsg1+llvm-1~exp3ubuntu1"]}],"products":[{"vendor":"rust-lang","product":"rust"}],"references":[{"url":"https://doc.rust-lang.org/beta/std/net/struct.Ipv4Addr.html","tags":["x_transferred","Vendor Advisory","advisory","report"]},{"url":"https://github.com/rust-lang/rust/pull/83652","tags":["x_transferred","Patch","Third Party Advisory","fix","report"]},{"url":"https://github.com/rust-lang/rust/issues/83648","tags":["x_transferred","Exploit","Issue Tracking","Patch","Third Party Advisory","fix","report"]},{"url":"https://github.com/sickcodes/security/blob/master/advisories/SICK-2021-015.md","tags":["x_transferred","Exploit","Third Party Advisory","evidence","report"]},{"url":"https://defcon.org/html/defcon-29/dc-29-speakers.html#kaoudis","tags":["x_transferred","Third Party Advisory","advisory","report"]},{"url":"https://security.gentoo.org/glsa/202210-09","tags":["vendor-advisory","x_transferred","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-29922","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-g9v3-gh27-qjh3"},{"url":"https://security.alpinelinux.org/vuln/CVE-2021-29922","tags":["advisory"]},{"url":"https://vulners.com/cve/CVE-2021-29922","tags":["report"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2021-29922","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2021-29922","tags":["advisory"]},{"url":"https://openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2021-1323","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2021:4270","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.5_release_notes/","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1991962","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_4270.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-29922","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-29922","tags":["advisory","report"]},{"url":"https://errata.rockylinux.org/RLSA-2021:4270","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2021-29922","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2021-29922","description":"library/std/src/net/parser.rs in Rust before 1.53.0 does not properly consider extraneous zero characters at the beginning of an IP address string, which (in some situations) allows attackers to bypass access control that is based on IP addresses, because of unexpected octal interpretation.","status":"published","published":"2021-08-07T00:00:00Z","modified":"2024-08-03T22:18:03.28Z","updated_at":"2026-11-02T14:33:06.658806Z"}],"euvd":[{"id":"EUVD-2021-16396","description":"library/std/src/net/parser.rs in Rust before 1.53.0 does not properly consider extraneous zero characters at the beginning of an IP address string, which (in some situations) allows attackers to bypass access control that is based on IP addresses, because of unexpected octal interpretation.","status":"published","published":"2021-08-07T00:00:00Z","modified":"2024-08-03T22:18:03Z","updated_at":"2026-11-03T03:24:43.413555Z"}],"ghsa":[{"id":"GHSA-g9v3-gh27-qjh3","title":"library/std/src/net/parser.rs in Rust before 1.53.0 does not properly consider extraneous zero...","description":"library/std/src/net/parser.rs in Rust before 1.53.0 does not properly consider extraneous zero characters at the beginning of an IP address string, which (in some situations) allows attackers to bypass access control that is based on IP addresses, because of unexpected octal interpretation.","status":"published","published":"2022-05-24T19:10:21Z","modified":"2023-01-30T05:04:57Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T14:47:09.636463Z"}],"nvd":[{"id":"CVE-2021-29922","description":"library/std/src/net/parser.rs in Rust before 1.53.0 does not properly consider extraneous zero characters at the beginning of an IP address string, which (in some situations) allows attackers to bypass access control that is based on IP addresses, because of unexpected octal interpretation.","status":"published","published":"2021-08-07T17:15:06.907Z","modified":"2026-06-17T03:48:27.207Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":6.4,"vector":"AV:N/AC:L/Au:N/C:N/I:P/A:P","level":"medium","assessor":"primary"}],"updated_at":"2026-11-02T14:06:56.562207Z"}],"osv":[{"id":"ALPINE-CVE-2021-29922","description":"library/std/src/net/parser.rs in Rust before 1.53.0 does not properly consider extraneous zero characters at the beginning of an IP address string, which (in some situations) allows attackers to bypass access control that is based on IP addresses, because of unexpected octal interpretation.","status":"published","published":"2021-08-07T17:15:06.907Z","modified":"2026-11-03T06:32:39.245165111Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","level":"critical"}],"updated_at":"2026-11-03T07:17:20.312441Z"},{"id":"BELL-CVE-2021-29922","title":"CVE-2021-29922 does not affect BellSoft software","status":"withdrawn","published":"2023-08-31T12:15:19.23969Z","modified":"2026-01-26T09:46:22.086278Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:28:15.925958Z"},{"id":"CVE-2021-29922","description":"library/std/src/net/parser.rs in Rust before 1.53.0 does not properly consider extraneous zero characters at the beginning of an IP address string, which (in some situations) allows attackers to bypass access control that is based on IP addresses, because of unexpected octal interpretation.","status":"published","published":"2021-08-07T17:15:06.907Z","modified":"2026-10-24T10:50:11.95611044Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:19.483607Z"},{"id":"DEBIAN-CVE-2021-29922","description":"library/std/src/net/parser.rs in Rust before 1.53.0 does not properly consider extraneous zero characters at the beginning of an IP address string, which (in some situations) allows attackers to bypass access control that is based on IP addresses, because of unexpected octal interpretation.","status":"published","published":"2021-08-07T17:15:06.907Z","modified":"2026-10-23T18:03:26.094396803Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:45:34.94143Z"},{"id":"OESA-2021-1323","title":"rust security update","description":"Rust is a systems programming language that runs blazingly fast, prevents segfaults, and guarantees thread safety.\r\n\r\nSecurity Fix(es):\r\n\r\nlibrary/std/src/net/parser.rs in Rust before 1.53.0 does not properly consider extraneous zero characters at the beginning of an IP address string, which (in some situations) allows attackers to bypass access control that is based on IP addresses, because of unexpected octal interpretation.(CVE-2021-29922)","status":"published","published":"2021-08-23T11:04:33Z","modified":"2026-08-18T01:15:57.322607577Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:38.987987Z"},{"id":"RHSA-2021:4270","title":"Red Hat Security Advisory: rust-toolset:rhel8 security, bug fix, and enhancement update","status":"published","published":"2024-09-14T01:24:35Z","modified":"2026-02-26T10:04:14Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"}],"updated_at":"2026-11-02T15:53:08.619234Z"},{"id":"RLSA-2021:4270","title":"Moderate: rust-toolset:rhel8 security, bug fix, and enhancement update","description":"Rust Toolset provides the Rust programming language compiler rustc, the cargo build tool and dependency manager, and required libraries. \n\nThe following packages have been upgraded to a later upstream version: rust (1.54.0). (BZ#1945805)\n\nSecurity Fix(es):\n\n* rust: incorrect parsing of extraneous zero characters at the beginning of an IP address string (CVE-2021-29922)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the Rocky Linux 8.5 Release Notes linked from the References section.","status":"published","published":"2021-11-09T08:54:06Z","modified":"2026-02-04T19:00:07.504108Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"}],"updated_at":"2026-11-02T15:53:23.969672Z"},{"id":"UBUNTU-CVE-2021-29922","description":"library/std/src/net/parser.rs in Rust before 1.53.0 does not properly consider extraneous zero characters at the beginning of an IP address string, which (in some situations) allows attackers to bypass access control that is based on IP addresses, because of unexpected octal interpretation.","status":"published","published":"2021-08-07T17:15:00Z","modified":"2026-04-22T12:51:38.940699Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:54:26.779273Z"},{"id":"ALSA-2021:4270","title":"Moderate: rust-toolset:rhel8 security, bug fix, and enhancement update","description":"Rust Toolset provides the Rust programming language compiler rustc, the cargo build tool and dependency manager, and required libraries. \n\nThe following packages have been upgraded to a later upstream version: rust (1.54.0). (BZ#1945805)\n\nSecurity Fix(es):\n\n* rust: incorrect parsing of extraneous zero characters at the beginning of an IP address string (CVE-2021-29922)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.","status":"published","published":"2021-11-09T08:54:06Z","modified":"2026-10-29T11:01:09.907354846Z","updated_at":"2026-11-02T15:27:51.196609Z"}]}}