CVE-2021-29921

In Python before 3,9,5, the ipaddress library mishandles leading zero characters in the octets of an IP address string. This (in some situations) allows attackers to bypass access control that is based on IP addresses.

CVSS 3.1

9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

6.9% chance of exploitation in the next 30 days; higher than 94% of CVEs (scores of 2026-10-25)

Published

2021-05-06

Modified

2026-10-08

Record from

the NVD, synced 2026-10-19

Affected

• oracle:communications_cloud_native_core_automated_test_suite
• oracle:communications_cloud_native_core_binding_support_function
• oracle:communications_cloud_native_core_network_slice_selection_function
• oracle:graalvm
• oracle:zfs_storage_appliance_kit
• python:python

References

• https://bugs.python.org/issue36384
• https://docs.python.org/3/library/ipaddress.html
• https://github.com/python/cpython/blob/63298930fb531ba2bb4f23bc3b915dbf1e17e9e1/Misc/NEWS.d/3.8.0a4.rst
• https://github.com/python/cpython/pull/12577
• https://github.com/python/cpython/pull/25099

Check your stackJSON