CVE-2021-20234 — Uncontrolled Resource Consumption in Libzmq

CWE-400 — Uncontrolled Resource ConsumptionCWE-401 — Missing Release of Memory after Effective Lifetime8 documents7 sources
Severity
6.5MEDIUMNVD
OSV9.8
EPSS
0.8%
top 25.92%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Zeromq LibzmqZeromq
Timeline
PublishedApr 1
Latest updateJun 15

Description

An uncontrolled resource consumption (memory leak) flaw was found in the ZeroMQ client in versions before 4.3.3 in src/pipe.cpp. This issue causes a client that connects to multiple malicious or compromised servers to crash. The highest threat from this vulnerability is to system availability.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:HExploitability: 2.8 | Impact: 3.6

Affected Packages2 packages

▶NVDzeromq/libzmq< 4.3.3
▶CVEListV5zeromq/zeromqzeromq 4.3.3

Patches

Patch: bugzilla.redhat.com ↗Patch: github.com ↗Patch: bugzilla.redhat.com ↗

🔴Vulnerability Details

4
OSV
zeromq3 vulnerabilities↗2022-06-15
▶
GHSA
GHSA-47vr-832f-crm9: An uncontrolled resource consumption (memory leak) flaw was found in the ZeroMQ client in versions before 4↗2022-05-24
▶
CVEList
CVE-2021-20234: An uncontrolled resource consumption (memory leak) flaw was found in the ZeroMQ client in versions before 4↗2021-04-01
▶
OSV
CVE-2021-20234: An uncontrolled resource consumption (memory leak) flaw was found in the ZeroMQ client in versions before 4↗2021-04-01
▶

📋Vendor Advisories

3
Ubuntu
ZeroMQ vulnerabilities↗2022-06-15
▶
Debian
CVE-2021-20234: zeromq3 - An uncontrolled resource consumption (memory leak) flaw was found in the ZeroMQ ...↗2021
▶
Red Hat
zeromq: Memory leak in client induced by malicious server without CURVE/ZAP↗2020-09-07
▶