Disclosure summary
In Python before 3,9,5, the ipaddress library mishandles leading zero characters in the octets of an IP address string. This (in some situations) allows attackers to bypass access control that is based on IP addresses.
Source-reported weakness categories
NVD-CWE-Other
Source-specific records & product guidance
Sources retain their own attribution and scoring. Follow the original record to confirm affected versions, fixed releases, and configuration conditions.
NIST National Vulnerability Database · NVD-CVE-2021-29921
Open original source · Updated Oct 08, 2026
Only CPE matches marked vulnerable=true are indexed. AND/OR platform conditions must be checked in the original NVD record.
| Vendor | Product / association | Version / bounds |
|---|---|---|
| python | python | * {"versionStartIncluding":"3.9.0","versionEndExcluding":"3.9.5"} |
| oracle | communications_cloud_native_core_automated_test_suite | 1.8.0 |
| oracle | communications_cloud_native_core_binding_support_function | 1.11.0 |
| oracle | communications_cloud_native_core_network_slice_selection_function | 1.8.0 |
| oracle | graalvm | 20.3.2 |
| oracle | graalvm | 21.1.0 |
| oracle | zfs_storage_appliance_kit | 8.8 |
Original records & references
- NIST NVD record
- CVE Program record
- bugs.python.org — Issue Tracking, Patch, Vendor Advisory
- docs.python.org — Vendor Advisory
- github.com — Third Party Advisory
- github.com — Patch, Third Party Advisory
- github.com — Patch, Third Party Advisory
- github.com — Third Party Advisory
- github.com — Exploit, Third Party Advisory
- python-security.readthedocs.io — Vendor Advisory
- security.gentoo.org
- security.netapp.com — Third Party Advisory
- sick.codes — Exploit, Third Party Advisory
- www.oracle.com — Patch, Third Party Advisory
- www.oracle.com — Patch, Third Party Advisory
- www.oracle.com — Patch, Third Party Advisory
- www.oracle.com
- www.oracle.com — Patch, Third Party Advisory
- bugs.python.org — Issue Tracking, Patch, Vendor Advisory
- docs.python.org — Vendor Advisory
- github.com — Third Party Advisory
- github.com — Patch, Third Party Advisory
- github.com — Patch, Third Party Advisory
- github.com — Third Party Advisory
- github.com — Exploit, Third Party Advisory
- lists.debian.org
- python-security.readthedocs.io — Vendor Advisory
- security.gentoo.org
- security.netapp.com — Third Party Advisory
- sick.codes — Exploit, Third Party Advisory
- www.oracle.com — Patch, Third Party Advisory
- www.oracle.com — Patch, Third Party Advisory
- www.oracle.com — Patch, Third Party Advisory
- www.oracle.com
- www.oracle.com — Patch, Third Party Advisory
PUBLISHED 2021-05-06T09:15:12-04:00
MODIFIED 2026-10-08T18:17:09-04:00
INGESTED 2026-10-10T20:50:20-04:00