CVE-2021-29923

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.7% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2021-08-07 · updated 2026-06-17

Description

Go before 1.17 does not properly consider extraneous zero characters at the beginning of an IP address octet, which (in some situations) allows attackers to bypass access control that is based on IP addresses, because of unexpected octal interpretation. This affects net.ParseIP and net.ParseCIDR.

Affected products

Fedoraproject Fedora: 36
Go: before 1.17 — fixed in 1.17
Oracle Corporation TimesTen In-Memory Database: before 21.1.1.1.0 — fixed in 21.1.1.1.0

How to fix

Upgrade to a fixed version: Go 1.17; Oracle Corporation TimesTen In-Memory Database 21.1.1.1.0. Check the vendor advisory for mitigations.

References

https://defcon.org/html/defcon-29/dc-29-speakers.html#kaoudis
https://github.com/golang/go/issues/30999
https://github.com/golang/go/issues/43389
https://github.com/sickcodes/security/blob/master/advisories/SICK-2021-016.md
https://go-review.googlesource.com/c/go/+/325829/
https://golang.org/pkg/net/#ParseCIDR
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4CHKSFMHZVOBCZSSVRE3UEYNKARTBMTM/
https://security.gentoo.org/glsa/202208-02
https://www.oracle.com/security-alerts/cpujan2022.html
https://defcon.org/html/defcon-29/dc-29-speakers.html#kaoudis
https://github.com/golang/go/issues/30999
https://github.com/golang/go/issues/43389

Get alerted when CVE-2021-29923 or the next vulnerability affects your stack