PatchTheCVElibzmq vulnerabilities and fixes
Recent CVEs affecting libzmq, with upgrade or downgrade steps. 7 tracked.
libzmq has 7 tracked vulnerabilities, 2 critical. A fixed release or vendor patch exists for 6. Most recent: 2021-07-01. Highest priority: CVE-2019-13132 (score 69/100).
- CVE-2021-20237 HIGH 7.5 UPGRADE An uncontrolled resource consumption (memory leak) flaw was found in ZeroMQ's src/xpub.cpp in versions before
- CVE-2021-20235 HIGH 8.1 UPGRADE There's a flaw in the zeromq server in versions before 4.3.3 in src/decoder_allocators.hpp
- CVE-2021-20234 MEDIUM 6.5 UPGRADE An uncontrolled resource consumption (memory leak) flaw was found in the ZeroMQ client in versions before 4.3.
- CVE-2020-36400 CRITICAL 9.8 DOWNGRADE ZeroMQ libzmq 4.3.3 has a heap-based buffer overflow in zmq::tcp_read, a different vulnerability than CVE-2021
- CVE-2020-15166 HIGH 7.5 UPGRADE MITIGATE In ZeroMQ before version 4.3.3, there is a denial-of-service vulnerability
- CVE-2019-6250 HIGH 8.8 UPGRADE MITIGATE A pointer overflow, with code execution, was discovered in ZeroMQ libzmq (aka 0MQ) 4.2.x and 4.3.x before 4.3.
- CVE-2019-13132 CRITICAL 9.8 UPGRADE MITIGATE In ZeroMQ libzmq before 4.0.9, 4.1.x before 4.1.7, and 4.2.x before 4.3.2, a remote, unauthenticated client co
FAQ
How do I fix libzmq vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is libzmq being exploited right now?
None of the tracked libzmq CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which libzmq CVE should I patch first?
CVE-2019-13132 currently ranks highest (69/100): In ZeroMQ libzmq before 4.0.9, 4.1.x before 4.1.7, and 4.2.x before 4.3.2, a remote, unauthenticated client co.