CVE-2021-33571

In Django 2.2 before 2.2.24, 3.x before 3.1.12, and 3.2 before 3.2.4, URLValidator, validate_ipv4_address, and validate_ipv46_address do not prohibit leading zero characters in octal literals. This may allow a bypass of access control that is based on IP addresses. (validate_ipv4_address and validate_ipv46_address are unaffected with Python 3.9.5+..) .

• CWE-918

• https://docs.djangoproject.com/en/3.2/releases/security/Patch, Vendor Advisory
• https://github.com/django/django/commit/203d4ab9ebcd72fc4d6eb7398e66ed9e474e118e
• https://github.com/django/django/commit/9f75e2e562fa0c0482f3dde6fc7399a9070b4a3d
• https://github.com/django/django/commit/f27c38ab5d90f68c9dd60cabef248a570c0be8fc
• https://groups.google.com/g/django-announce/c/sPyjSKMi8EoMailing List, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/B4SQG2EAF4WCI2SLRL6XRDJ3RPK3ZRDV/
• https://security.netapp.com/advisory/ntap-20210727-0004/Third Party Advisory
• https://www.djangoproject.com/weblog/2021/jun/02/security-releases/Patch, Vendor Advisory
• https://docs.djangoproject.com/en/3.2/releases/security/Patch, Vendor Advisory
• https://github.com/django/django/commit/203d4ab9ebcd72fc4d6eb7398e66ed9e474e118e
• https://github.com/django/django/commit/9f75e2e562fa0c0482f3dde6fc7399a9070b4a3d
• https://github.com/django/django/commit/f27c38ab5d90f68c9dd60cabef248a570c0be8fc
• https://groups.google.com/g/django-announce/c/sPyjSKMi8EoMailing List, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/B4SQG2EAF4WCI2SLRL6XRDJ3RPK3ZRDV/
• https://security.netapp.com/advisory/ntap-20210727-0004/Third Party Advisory
• https://www.djangoproject.com/weblog/2021/jun/02/security-releases/Patch, Vendor Advisory

Published

Jun 8, 2021

Last Modified

Jun 17, 2026

Status

Modified

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-33560Libgcrypt before 1.8.8 and 1.9.x before 1.9.3 mishandles ElG…7.5
• CVE-2021-33561A stored cross-site scripting (XSS) vulnerability in Shopize…4.8
• CVE-2021-33562A reflected cross-site scripting (XSS) vulnerability in Shop…4.8
• CVE-2021-33563Koel before 5.1.4 lacks login throttling, lacks a password s…7.5
• CVE-2021-33564An argument injection vulnerability in the Dragonfly gem bef…9.8
• CVE-2021-33570Postbird 0.8.4 allows stored XSS via the onerror attribute o…5.4
• CVE-2021-33572A Denial-of-Service (DoS) vulnerability was discovered in F-…6.5
• CVE-2021-33574The mq_notify function in the GNU C Library (aka glibc) vers…9.8
• CVE-2021-33575The Pixar ruby-jss gem before 1.6.0 allows remote attackers …9.8
• CVE-2021-33576An issue was discovered in Cleo LexiCom 5.5.0.0. Within the …9.8
• CVE-2021-33577An issue was discovered in Cleo LexiCom 5.5.0.0. The require…5.3
• CVE-2021-33578Echo ShareCare 8.15.5 is susceptible to SQL injection vulner…9.8