CVE-2021-20237 Denial of service in zeromq
Remote attackers can cause denial of service via memory exhaustion in ZeroMQ when authentication is disabled.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-20237?
CVE-2021-20237 is a high-severity denial of service vulnerability in zeromq, published on 28 May 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An uncontrolled resource consumption (memory leak) flaw was found in ZeroMQ's src/xpub.cpp in versions before 4.3.3. This flaw allows a remote unauthenticated attacker to send crafted PUB messages that consume excessive memory if the CURVE/ZAP authentication is disabled on the server, causing a denial of service. The highest threat from this vulnerability is to system availability.
Which versions are affected by CVE-2021-20237?
It affects 1 product.
Products include Zeromq Libzmq.
How do I fix CVE-2021-20237?
Upgrade to a fixed version.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2021-20237 being exploited?
There is no known exploitation of CVE-2021-20237 in the wild and no public exploit code.
Other vulnerabilities in zeromq
Sources
Also known as DEBIAN-CVE-2021-20237, GHSA-4p5v-h92w-6wxw, GHSA-98wx-fq4r-jfm2, JLSEC-2026-517, UBUNTU-CVE-2021-20237.