CriticalFix available
pypy3 — security advisory
In Python before 3,9,5, the ipaddress library mishandles leading zero characters in the octets of an IP address string. This (in some situations) allows attackers to bypass access control that is based on IP addresses.
- Products
- pypy3
- Affected versions
- Not specified
- Fixed versions
- 7.3.8+dfsg-1
- CVEs
- CVE-2021-29921
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 28 Oct 2026, 11:07 UTC · Revision 1
Source evidence
In Python before 3,9,5, the ipaddress library mishandles leading zero characters in the octets of an IP address string. This (in some situations) allows attackers to bypass access control that is based on IP addresses.
osv:DEBIAN-CVE-2021-29921
pypy3
Fixed versions: 7.3.8+dfsg-1
pypy3
Fixed versions: 7.3.8+dfsg-1
pypy3
Fixed versions: 7.3.8+dfsg-1
Complete source record
{
"id": "48f0c1c8b1fdefcd4b83a036d20e60a632f11268cc4cd64a68b02a14a28236bb",
"url": "https://osv.dev/vulnerability/DEBIAN-CVE-2021-29921",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "DEBIAN-CVE-2021-29921",
"summary": "In Python before 3,9,5, the ipaddress library mishandles leading zero characters in the octets of an IP address string. This (in some situations) allows attackers to bypass access control that is based on IP addresses.",
"evidence": "osv:DEBIAN-CVE-2021-29921",
"products": [
{
"name": {
"value": "pypy3",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "7.3.8+dfsg-1",
"evidence": "/affected/0/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "pypy3",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "7.3.8+dfsg-1",
"evidence": "/affected/1/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "pypy3",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "7.3.8+dfsg-1",
"evidence": "/affected/2/ranges"
}
],
"affected_versions": []
}
],
"severity": "critical",
"structured": {
"id": "DEBIAN-CVE-2021-29921",
"aliases": [
"DEBIAN-CVE-2021-29921"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "7.3.8+dfsg-1"
}
]
}
],
"package": {
"name": "pypy3",
"purl": "pkg:deb/debian/pypy3?arch=source&distro=bookworm",
"ecosystem": "Debian:12"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2021-29921.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "7.3.8+dfsg-1"
}
]
}
],
"package": {
"name": "pypy3",
"purl": "pkg:deb/debian/pypy3?arch=source&distro=trixie",
"ecosystem": "Debian:13"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2021-29921.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "7.3.8+dfsg-1"
}
]
}
],
"package": {
"name": "pypy3",
"purl": "pkg:deb/debian/pypy3?arch=source&distro=forky",
"ecosystem": "Debian:14"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2021-29921.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
}
],
"modified": "2026-10-09T09:47:27.715607994Z",
"provider": "osv",
"upstream": [
"CVE-2021-29921"
],
"references": [
"https://security-tracker.debian.org/tracker/CVE-2021-29921"
]
},
"related_cves": [
{
"value": "CVE-2021-29921",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 111532,
"published_at": "2021-05-06T13:15:12.573+00:00"
}