Description
library/std/src/net/parser.rs in Rust before 1.53.0 does not properly consider extraneous zero characters at the beginning of an IP address string, which (in some situations) allows attackers to bypass access control that is based on IP addresses, because of unexpected octal interpretation.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | rustc | 1.53.0+dfsg1-1 | — |
| Debian 13 | rustc | 1.53.0+dfsg1-1 | — |
| Debian 12 | rustc | 1.53.0+dfsg1-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 22.04 LTS | rustc | 1.53.0+dfsg1+llvm-4ubuntu1 | — |
| Ubuntu 20.04 LTS | rustc | 1.53.0+dfsg1+llvm-4ubuntu1~20.04.1 | — |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 16.04 LTS | rustc | No fix yet | — |
| Ubuntu Pro 14.04 LTS | rustc | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 8 | rls +13 | 1.54.0-2.module+el8.5.0+12254+dc27bae9 | RHSA-2021:4270 |
| RHEL 8 | rust-toolset | 1.54.0-1.module+el8.5.0+12195+effd8a03 | RHSA-2021:4270 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 8 | rust-toolset | 1.54.0-1.module_el8.5.0+2599+d655d86c | ALSA-2021:4270 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 8 | rust | 1.54.0-2.module+el8.5.0+678+cf7bc64b | RLSA-2021:4270 |
| Rocky Linux 8 | rust-toolset | 1.54.0-1.module+el8.5.0+678+cf7bc64b | RLSA-2021:4270 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | rust +1 | 1.52.1-r1 | — |
| Alpine v3.23 | rust | 1.52.1-r1 | — |
| Alpine v3.22 | rust | 1.52.1-r1 | — |
| Alpine v3.21 | rust | 1.52.1-r1 | — |
| Alpine v3.20 | rust | 1.52.1-r1 | — |
Show 6 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.19 | rust | 1.52.1-r1 | — |
| Alpine v3.18 | rust | 1.52.1-r1 | — |
| Alpine v3.17 | rust | 1.52.1-r1 | — |
| Alpine v3.16 | rust | 1.52.1-r1 | — |
| Alpine v3.15 | rust | 1.52.1-r1 | — |
| Alpine v3.14 | rust | 1.52.1-r1 | — |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 8 | rls +13 | 1.54.0-2.module+el8.5.0+20381+6e029bfc | ELSA-2021-4270 |
| Oracle Linux 8 | rust-toolset | 1.54.0-1.module+el8.5.0+20381+6e029bfc | ELSA-2021-4270 |
Advisories 5
- ALSA-2021:4270 Moderate: rust-toolset:rhel8 security, bug fix, and enhancement update AlmaLinux Security Advisories · Oct 29, 2026
- WID-SEC-2022-0571 Red Hat Enterprise Linux: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jun 28, 2026
- RHSA-2021:4270 Red Hat Security Advisory: rust-toolset:rhel8 security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Feb 26, 2026
- RLSA-2021:4270 Moderate: rust-toolset:rhel8 security, bug fix, and enhancement update Rocky Linux Security Advisories · Feb 4, 2026
- ELSA-2021-4270 Moderate: rust-toolset:ol8 security, bug fix, and enhancement update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Nov 16, 2021
References
- https://doc.rust-lang.org/beta/std/net/struct.Ipv4Addr.html
- https://github.com/rust-lang/rust/pull/83652
- https://github.com/rust-lang/rust/issues/83648
- https://github.com/sickcodes/security/blob/master/advisories/SICK-2021-015.md
- https://defcon.org/html/defcon-29/dc-29-speakers.html#kaoudis
- GLSA-202210-09 vendor-advisory