CVE-2020-15166CWE-400

Denial of Service in ZeroMQ

High · published September 11, 2020

CVSS v3.1
7.5
EPSS
3%
Percentile
88.8
In the wild
Unconfirmed
What it is

In ZeroMQ before version 4.3.3, there is a denial-of-service vulnerability. Users with TCP transport public endpoints, even with CURVE/ZAP enabled, are impacted. If a raw TCP socket is opened and connected to an endpoint that is fully configured with CURVE/ZAP, legitimate clients will not be able to exchange any message. Handshakes complete successfully, and messages are delivered to the library, but the server application never receives them. This is patched in version 4.3.3.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.03408 · 88.8th percentile
Weakness
CWE-400 · Uncontrolled Resource Consumption
Published
2020-09-11T15:35Z
EPSS history
Timeline
  • 11 SEP 15:35Z
    Denial of Service in ZeroMQ
    cvelistv5