CriticalFix available
python3 — security advisory
In Python before 3,9,5, the ipaddress library mishandles leading zero characters in the octets of an IP address string. This (in some situations) allows attackers to bypass access control that is based on IP addresses.
- Products
- python3
- Affected versions
- Not specified
- Fixed versions
- 3.9.5-r0
- CVEs
- CVE-2021-29921
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 31 Oct 2026, 22:04 UTC · Revision 1
Source evidence
In Python before 3,9,5, the ipaddress library mishandles leading zero characters in the octets of an IP address string. This (in some situations) allows attackers to bypass access control that is based on IP addresses.
osv:ALPINE-CVE-2021-29921
python3
Fixed versions: 3.9.5-r0
python3
Fixed versions: 3.9.5-r0
python3
Fixed versions: 3.9.5-r0
python3
Fixed versions: 3.9.5-r0
python3
Fixed versions: 3.9.5-r0
python3
Fixed versions: 3.9.5-r0
python3
Fixed versions: 3.9.5-r0
python3
Fixed versions: 3.9.5-r0
python3
Fixed versions: 3.9.5-r0
python3
Fixed versions: 3.9.5-r0
Complete source record
{
"id": "47ac61fccc2fb38e3a4d7c2a7c196f61210548df2bb25f8c001308e853f126a8",
"url": "https://osv.dev/vulnerability/ALPINE-CVE-2021-29921",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "ALPINE-CVE-2021-29921",
"summary": "In Python before 3,9,5, the ipaddress library mishandles leading zero characters in the octets of an IP address string. This (in some situations) allows attackers to bypass access control that is based on IP addresses.",
"evidence": "osv:ALPINE-CVE-2021-29921",
"products": [
{
"name": {
"value": "python3",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "3.9.5-r0",
"evidence": "/affected/0/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "python3",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "3.9.5-r0",
"evidence": "/affected/1/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "python3",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "3.9.5-r0",
"evidence": "/affected/2/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "python3",
"evidence": "/affected/3/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "3.9.5-r0",
"evidence": "/affected/3/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "python3",
"evidence": "/affected/4/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "3.9.5-r0",
"evidence": "/affected/4/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "python3",
"evidence": "/affected/5/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "3.9.5-r0",
"evidence": "/affected/5/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "python3",
"evidence": "/affected/6/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "3.9.5-r0",
"evidence": "/affected/6/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "python3",
"evidence": "/affected/7/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "3.9.5-r0",
"evidence": "/affected/7/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "python3",
"evidence": "/affected/8/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "3.9.5-r0",
"evidence": "/affected/8/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "python3",
"evidence": "/affected/9/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "3.9.5-r0",
"evidence": "/affected/9/ranges"
}
],
"affected_versions": []
}
],
"severity": "critical",
"structured": {
"id": "ALPINE-CVE-2021-29921",
"aliases": [
"ALPINE-CVE-2021-29921"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "3.9.5-r0"
}
]
}
],
"package": {
"name": "python3",
"purl": "pkg:apk/alpine/python3?arch=source",
"ecosystem": "Alpine:v3.15"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2021-29921.json"
},
"ecosystem_specific": {}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "3.9.5-r0"
}
]
}
],
"package": {
"name": "python3",
"purl": "pkg:apk/alpine/python3?arch=source",
"ecosystem": "Alpine:v3.16"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2021-29921.json"
},
"ecosystem_specific": {}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "3.9.5-r0"
}
]
}
],
"package": {
"name": "python3",
"purl": "pkg:apk/alpine/python3?arch=source",
"ecosystem": "Alpine:v3.17"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2021-29921.json"
},
"ecosystem_specific": {}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "3.9.5-r0"
}
]
}
],
"package": {
"name": "python3",
"purl": "pkg:apk/alpine/python3?arch=source",
"ecosystem": "Alpine:v3.18"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2021-29921.json"
},
"ecosystem_specific": {}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "3.9.5-r0"
}
]
}
],
"package": {
"name": "python3",
"purl": "pkg:apk/alpine/python3?arch=source",
"ecosystem": "Alpine:v3.19"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2021-29921.json"
},
"ecosystem_specific": {}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "3.9.5-r0"
}
]
}
],
"package": {
"name": "python3",
"purl": "pkg:apk/alpine/python3?arch=source",
"ecosystem": "Alpine:v3.20"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2021-29921.json"
},
"ecosystem_specific": {}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "3.9.5-r0"
}
]
}
],
"package": {
"name": "python3",
"purl": "pkg:apk/alpine/python3?arch=source",
"ecosystem": "Alpine:v3.21"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2021-29921.json"
},
"ecosystem_specific": {}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "3.9.5-r0"
}
]
}
],
"package": {
"name": "python3",
"purl": "pkg:apk/alpine/python3?arch=source",
"ecosystem": "Alpine:v3.22"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2021-29921.json"
},
"ecosystem_specific": {}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "3.9.5-r0"
}
]
}
],
"package": {
"name": "python3",
"purl": "pkg:apk/alpine/python3?arch=source",
"ecosystem": "Alpine:v3.23"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2021-29921.json"
},
"ecosystem_specific": {}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "3.9.5-r0"
}
]
}
],
"package": {
"name": "python3",
"purl": "pkg:apk/alpine/python3?arch=source",
"ecosystem": "Alpine:v3.24"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2021-29921.json"
},
"ecosystem_specific": {}
}
],
"modified": "2026-10-23T17:17:56.181410209Z",
"provider": "osv",
"upstream": [
"CVE-2021-29921"
],
"references": [
"https://security.alpinelinux.org/vuln/CVE-2021-29921"
]
},
"related_cves": [
{
"value": "CVE-2021-29921",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 415414,
"published_at": "2021-05-06T13:15:12.573+00:00"
}