CriticalFix available
rust — security advisory
library/std/src/net/parser.rs in Rust before 1.53.0 does not properly consider extraneous zero characters at the beginning of an IP address string, which (in some situations) allows attackers to bypass access control that is based on IP addresses, because of unexpected octal interpretation.
- Products
- rust
- Affected versions
- Not specified
- Fixed versions
- 1.52.1-r1
- CVEs
- CVE-2021-29922
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 31 Oct 2026, 22:04 UTC · Revision 1
Source evidence
library/std/src/net/parser.rs in Rust before 1.53.0 does not properly consider extraneous zero characters at the beginning of an IP address string, which (in some situations) allows attackers to bypass access control that is based on IP addresses, because of unexpected octal interpretation.
osv:ALPINE-CVE-2021-29922
rust
Fixed versions: 1.52.1-r1
rust
Fixed versions: 1.52.1-r1
rust
Fixed versions: 1.52.1-r1
rust
Fixed versions: 1.52.1-r1
rust
Fixed versions: 1.52.1-r1
rust
Fixed versions: 1.52.1-r1
Complete source record
{
"id": "6d7c5650841352509419b0751b5b39c9414ad115df49a417e961c19d836b43df",
"url": "https://osv.dev/vulnerability/ALPINE-CVE-2021-29922",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "ALPINE-CVE-2021-29922",
"summary": "library/std/src/net/parser.rs in Rust before 1.53.0 does not properly consider extraneous zero characters at the beginning of an IP address string, which (in some situations) allows attackers to bypass access control that is based on IP addresses, because of unexpected octal interpretation.",
"evidence": "osv:ALPINE-CVE-2021-29922",
"products": [
{
"name": {
"value": "rust",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "1.52.1-r1",
"evidence": "/affected/0/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "rust",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "1.52.1-r1",
"evidence": "/affected/1/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "rust",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "1.52.1-r1",
"evidence": "/affected/2/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "rust",
"evidence": "/affected/3/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "1.52.1-r1",
"evidence": "/affected/3/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "rust",
"evidence": "/affected/4/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "1.52.1-r1",
"evidence": "/affected/4/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "rust",
"evidence": "/affected/5/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "1.52.1-r1",
"evidence": "/affected/5/ranges"
}
],
"affected_versions": []
}
],
"severity": "critical",
"structured": {
"id": "ALPINE-CVE-2021-29922",
"aliases": [
"ALPINE-CVE-2021-29922"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H"
}
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.52.1-r1"
}
]
}
],
"package": {
"name": "rust",
"purl": "pkg:apk/alpine/rust?arch=source",
"ecosystem": "Alpine:v3.19"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2021-29922.json"
},
"ecosystem_specific": {}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.52.1-r1"
}
]
}
],
"package": {
"name": "rust",
"purl": "pkg:apk/alpine/rust?arch=source",
"ecosystem": "Alpine:v3.20"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2021-29922.json"
},
"ecosystem_specific": {}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.52.1-r1"
}
]
}
],
"package": {
"name": "rust",
"purl": "pkg:apk/alpine/rust?arch=source",
"ecosystem": "Alpine:v3.21"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2021-29922.json"
},
"ecosystem_specific": {}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.52.1-r1"
}
]
}
],
"package": {
"name": "rust",
"purl": "pkg:apk/alpine/rust?arch=source",
"ecosystem": "Alpine:v3.22"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2021-29922.json"
},
"ecosystem_specific": {}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.52.1-r1"
}
]
}
],
"package": {
"name": "rust",
"purl": "pkg:apk/alpine/rust?arch=source",
"ecosystem": "Alpine:v3.23"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2021-29922.json"
},
"ecosystem_specific": {}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.52.1-r1"
}
]
}
],
"package": {
"name": "rust",
"purl": "pkg:apk/alpine/rust?arch=source",
"ecosystem": "Alpine:v3.24"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2021-29922.json"
},
"ecosystem_specific": {}
}
],
"modified": "2026-10-23T17:17:56.181570216Z",
"provider": "osv",
"upstream": [
"CVE-2021-29922"
],
"references": [
"https://security.alpinelinux.org/vuln/CVE-2021-29922"
]
},
"related_cves": [
{
"value": "CVE-2021-29922",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 415416,
"published_at": "2021-08-07T17:15:06.907+00:00"
}