CVE-2020-15166 - CVE House
Back to Database
Status published High CVE-2020-15166

Denial of Service in ZeroMQ

Vulnerability Description

In ZeroMQ before version 4.3.3, there is a denial-of-service vulnerability. Users with TCP transport public endpoints, even with CURVE/ZAP enabled, are impacted. If a raw TCP socket is opened and connected to an endpoint that is fully configured with CURVE/ZAP, legitimate clients will not be able to exchange any message. Handshakes complete successfully, and messages are delivered to the library, but the server application never receives them. This is patched in version 4.3.3.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2020-15166

Credits & Attribution

No credits recorded in the NVD database.

References

More from zeromq

View All →
CVE-2020-36400
ZeroMQ libzmq 4.3.3 has a heap-based buffer overflow in zmq::tcp_read,...
Critical 9.8
CVE-2019-6250
A pointer overflow, with code execution, was discovered in ZeroMQ...
High 8.8
CVE-2019-13132
In ZeroMQ libzmq before 4.0.9, 4.1.x before 4.1.7, and 4.2.x...
Critical 9.8
CVE-2014-9721
libzmq before 4.0.6 and 4.1.x before 4.1.1 allows remote attackers...
Medium 4.3
CVE-2014-7203
libzmq (aka ZeroMQ/C++) 4.0.x before 4.0.5 does not ensure that...
Medium 4.3

Affected Vendor

Affected Software

libzmq
Vulnerable Versions:
< 4.3.3

Timeline

Official Publish: September 11th, 2020
Last Modified: August 4th, 2024
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weaknesses (CWE)

CWE-400

MITRE ATT&CK TTPs

T1499 Endpoint Denial of Service
Impact
T1498 Network Denial of Service
Impact