In ZeroMQ before version 4.3.3, there is a denial-of-service vulnerability. Users with TCP transport public endpoints, even with CURVE/ZAP enabled, are impacted. If a raw TCP socket is opened and connected to an endpoint that is fully configured with CURVE/ZAP, legitimate clients will not be able to exchange any message. Handshakes complete successfully, and messages are delivered to the library, but the server application never receives them. This is patched in version 4.3.3.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade zeromq | Sep 23, 2020 | Sep 11, 2020 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Sep 11, 2020 |
| Debian | — | Upgrade zeromq3 | Sep 9, 2020 | Sep 9, 2020 |
| Freebsd | — | Upgrade libzmq4 | Nov 4, 2022 | May 25, 2021 |
| Gentoo Linux | — | Upgrade net-libs/zeromq. | Sep 14, 2020 | Sep 11, 2020 |
| Suse | — | Upgrade libzmq5-32bitUpgrade libunwind-develUpgrade libunwindUpgrade zeromq-toolsUpgrade libunwind-32bitUpgrade zeromq-develUpgrade libzmq5 | Nov 12, 2020 | Sep 11, 2020 |
| Ubuntu | — | Upgrade libzmq3 (Ubuntu Pro)Upgrade libzmq5 (Ubuntu Pro) | Mar 22, 2023 | Sep 11, 2020 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Sep 11, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub