Skip to content
Fencer Intel
critical 9.1

CVE-2021-29922 json

library/std/src/net/parser.rs in Rust before 1.53.0 does not properly consider extraneous zero characters at the beginning of an IP address…

published 5y ago modified 4mo ago also EUVD-2021-16396

cvss
9.1
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
2.5%
EPSS 2.5% chance of exploitation in 30 days, percentile 84%
public exploits
0
none known

Summary

library/std/src/net/parser.rs in Rust before 1.53.0 does not properly consider extraneous zero characters at the beginning of an IP address string, which (in some situations) allows attackers to bypass access control that is based on IP addresses, because of unexpected octal interpretation.

Patch / fix

  • rust-lang rust 1.53.0
  • rustc Debian 14, Debian 13, Debian 12 1.53.0+dfsg1-1

debian advisories DEBIAN-CVE-2021-29922

  • rustc Ubuntu 20.04 LTS 1.53.0+dfsg1+llvm-4ubuntu1~20.04.1
  • rustc Ubuntu 22.04 LTS 1.53.0+dfsg1+llvm-4ubuntu1

ubuntu advisories UBUNTU-CVE-2021-29922

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • rls RHEL 8 1.54.0-2.module+el8.5.0+12254+dc27bae9
  • rust RHEL 8 1.54.0-2.module+el8.5.0+12254+dc27bae9
  • cargo RHEL 8 1.54.0-2.module+el8.5.0+12254+dc27bae9
  • clippy RHEL 8 1.54.0-2.module+el8.5.0+12254+dc27bae9
  • rustfmt RHEL 8 1.54.0-2.module+el8.5.0+12254+dc27bae9
  • rust-gdb RHEL 8 1.54.0-2.module+el8.5.0+12254+dc27bae9
  • rust-src RHEL 8 1.54.0-2.module+el8.5.0+12254+dc27bae9
  • rust-lldb RHEL 8 1.54.0-2.module+el8.5.0+12254+dc27bae9

red hat advisories RHSA-2021:4270

  • rust-toolset AlmaLinux 8 1.54.0-1.module_el8.5.0+2599+d655d86c

almalinux advisories ALSA-2021:4270

  • rust Rocky Linux 8 1.54.0-2.module+el8.5.0+678+cf7bc64b
  • rust-toolset Rocky Linux 8 1.54.0-1.module+el8.5.0+678+cf7bc64b

rocky linux advisories RLSA-2021:4270

  • rust Alpine 3.24, Alpine 3.23, Alpine 3.22 +8 more 1.52.1-r1
  • chromium-rust Alpine 3.24 1.52.1-r1

alpine advisories ALPINE-CVE-2021-29922

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • rust Arch Linux 1.53.0-1

arch linux advisories AVG-2263

Is CVE-2021-29922 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2021-29922 updated cvss 7.3

rust: incorrect parsing of extraneous zero characters at the beginning of an IP address string

  • Red Hat Enterprise Linux AppStream (v. 8) rls 1.54.0-2.module+el8.5.0+12254+dc27bae9, rust 1.54.0-2.module+el8.5.0+12254+dc27bae9, cargo 1.54.0-2.module+el8.5.0+12254+dc27bae9, clippy 1.54.0-2.module+el8.5.0+12254+dc27bae9, rustfmt 1.54.0-2.module+el8.5.0+12254+dc27bae9, rust-gdb 1.54.0-2.module+el8.5.0+12254+dc27bae9, +6 more
    fixed: vendor fix RHSA-2021:4270
  • Red Hat Enterprise Linux 9 rust, cargo, clippy, rustfmt, rust-gdb, rust-src, +8 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

2.45% chance of exploitation in the next 30 days, higher than 84% of all scored CVEs (FIRST EPSS, 2026-11-09).

Exploits and checks

  • github.com https://github.com/rust-lang/rust/issues/83648 referenced PoC, tagged "exploit" by a source, unverified
  • github.com https://github.com/sickcodes/security/blob/master/advisories/SICK-2021-015.md referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
NVD 3.1 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
NVD 2.0 6.4 AV:N/AC:L/Au:N/C:N/I:P/A:P

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.