CVE-2021-29923

Go before 1.17 does not properly consider extraneous zero characters at the beginning of an IP address octet, which (in some situations) allows attackers to bypass access control that is based on IP addresses, because of unexpected octal interpretation. This affects net.ParseIP and net.ParseCIDR.

• https://defcon.org/html/defcon-29/dc-29-speakers.html#kaoudisThird Party Advisory
• https://github.com/golang/go/issues/30999Exploit, Issue Tracking, Third Party Advisory
• https://github.com/golang/go/issues/43389Issue Tracking, Third Party Advisory
• https://github.com/sickcodes/security/blob/master/advisories/SICK-2021-016.mdExploit, Third Party Advisory
• https://go-review.googlesource.com/c/go/+/325829/Patch, Third Party Advisory
• https://golang.org/pkg/net/#ParseCIDRVendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4CHKSFMHZVOBCZSSVRE3UEYNKARTBMTM/
• https://security.gentoo.org/glsa/202208-02Third Party Advisory
• https://www.oracle.com/security-alerts/cpujan2022.htmlPatch, Third Party Advisory
• https://defcon.org/html/defcon-29/dc-29-speakers.html#kaoudisThird Party Advisory
• https://github.com/golang/go/issues/30999Exploit, Issue Tracking, Third Party Advisory
• https://github.com/golang/go/issues/43389Issue Tracking, Third Party Advisory
• https://github.com/sickcodes/security/blob/master/advisories/SICK-2021-016.mdExploit, Third Party Advisory
• https://go-review.googlesource.com/c/go/+/325829/Patch, Third Party Advisory
• https://golang.org/pkg/net/#ParseCIDRVendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4CHKSFMHZVOBCZSSVRE3UEYNKARTBMTM/
• https://security.gentoo.org/glsa/202208-02Third Party Advisory
• https://www.oracle.com/security-alerts/cpujan2022.htmlPatch, Third Party Advisory

Published

Aug 7, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-29907IBM OpenPages with Watson 8.1 and 8.2 could allow an authent…8.8
• CVE-2021-29908The IBM TS7700 Management Interface is vulnerable to unauthe…9.8
• CVE-2021-29912IBM Security Risk Manager on CP4S 1.7.0.0 is vulnerable to c…5.4
• CVE-2021-29913 IBM Security Verify Privilege On-Premise 11.5 could allow a…7.1
• CVE-2021-29921In Python before 3,9,5, the ipaddress library mishandles lea…9.8
• CVE-2021-29922library/std/src/net/parser.rs in Rust before 1.53.0 does not…9.1
• CVE-2021-29929An issue was discovered in the endian_trait crate through 20…7.5
• CVE-2021-29930An issue was discovered in the arenavec crate through 2021-0…7.5
• CVE-2021-29931An issue was discovered in the arenavec crate through 2021-0…7.5
• CVE-2021-29932An issue was discovered in the parse_duration crate through …7.5
• CVE-2021-29933An issue was discovered in the insert_many crate through 202…7.5
• CVE-2021-29934An issue was discovered in PartialReader in the uu_od crate …7.3