The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
In ZeroMQ before version 4.3.3, there is a denial-of-service vulnerability. Users with TCP transport public endpoints, even with CURVE/ZAP enabled, are impacted. If a raw TCP socket is opened and connected to an endpoint that is fully configured with CURVE/ZAP, legitimate clients will not be able to exchange any message. Handshakes complete successfully, and messages are delivered to the library, but the server application never receives them. This is patched in version 4.3.3.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade zeromq | Sep 23, 2020 | Sep 11, 2020 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Sep 11, 2020 |
| Debian | — | Upgrade zeromq3 | Sep 9, 2020 | Sep 9, 2020 |
| Freebsd | — | Upgrade libzmq4 | Nov 4, 2022 | May 25, 2021 |
| Gentoo Linux | — | Upgrade net-libs/zeromq. | Sep 14, 2020 | Sep 11, 2020 |
| Suse | — | Upgrade zeromq-develUpgrade libzmq5Upgrade libunwind-32bitUpgrade zeromq-toolsUpgrade libunwind-develUpgrade libunwindUpgrade libzmq5-32bit | Nov 12, 2020 | Sep 11, 2020 |
| Ubuntu | — | Upgrade libzmq5 (Ubuntu Pro)Upgrade libzmq3 (Ubuntu Pro) | Mar 22, 2023 | Sep 11, 2020 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Sep 11, 2020 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub