CVE catalog

CVE-2020-15166

zeromq3: CVE-2020-15166

[CVE catalog]

Severity
High · CVSS 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Published
Source
[NVD] · [CVE record]
EPSS
3.32% · Oct 25, 2026

In ZeroMQ before version 4.3.3, there is a denial-of-service vulnerability. Users with TCP transport public endpoints, even with CURVE/ZAP enabled, are impacted. If a raw TCP socket is opened and connected to an endpoint that is fully configured with CURVE/ZAP, legitimate clients will not be able to exchange any message. Handshakes complete successfully, and messages are delivered to the library, but the server application never receives them. This is patched in version 4.3.3.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianzeromq3sid4.3.5-1fixed
Debianzeromq3forky4.3.5-1fixed
Debianzeromq3trixie4.3.5-1fixed
Debianzeromq3bookworm4.3.4-6fixed
Alpinezeromq3.104.3.3-r0fixed
Alpinezeromq3.114.3.3-r0fixed
Alpinezeromq3.124.3.3-r0fixed
Alpinezeromq3.134.3.3-r0fixed
Alpinezeromq3.144.3.3-r0fixed
Alpinezeromq3.154.3.3-r0fixed
Alpinezeromq3.164.3.3-r0fixed
Alpinezeromq3.174.3.3-r0fixed
Alpinezeromq3.184.3.3-r0fixed
Alpinezeromq3.194.3.3-r0fixed
Alpinezeromq3.204.3.3-r0fixed
Alpinezeromq3.214.3.3-r0fixed
Alpinezeromq3.224.3.3-r0fixed
Alpinezeromq3.234.3.3-r0fixed
Alpinezeromq3.244.3.3-r0fixed
Alpinezeromq3.94.3.3-r0fixed
Ubuntuzeromq3pro4.3.2-1vulnerable
Ubuntuzeromq3pro4.3.2-2vulnerable
Ubuntuzeromq3pro4.3.2-2ubuntu1vulnerable
Ubuntuzeromq3pro4.3.2-2ubuntu1.20.04.1~esm1fixed
Suselibunwindlinux enterprise module for basesystem 15 sp11.2.1-4.2.3fixed
Susezeromqlinux enterprise module for basesystem 15 sp14.2.3-3.15.4fixed
Suselibunwindlinux enterprise module for basesystem 15 sp21.2.1-4.2.3fixed
Susezeromqlinux enterprise module for basesystem 15 sp24.2.3-3.15.4fixed
Suselibunwindlinux enterprise module for package hub 15 sp11.2.1-4.2.3fixed
Suselibunwindlinux enterprise module for package hub 15 sp21.2.1-4.2.3fixed
Suselibunwindlinux enterprise high performance computing 15-espos1.2.1-4.2.3fixed
Susezeromqlinux enterprise high performance computing 15-espos4.2.3-3.15.4fixed
Suselibunwindlinux enterprise high performance computing 15-ltss1.2.1-4.2.3fixed
Susezeromqlinux enterprise high performance computing 15-ltss4.2.3-3.15.4fixed
Suselibunwindlinux enterprise server 15-ltss1.2.1-4.2.3fixed
Susezeromqlinux enterprise server 15-ltss4.2.3-3.15.4fixed
Suselibunwindlinux enterprise server for sap applications 151.2.1-4.2.3fixed
Susezeromqlinux enterprise server for sap applications 154.2.3-3.15.4fixed
Opensuselibunwindleap 15.21.2.1-lp152.5.3.1fixed
Opensusezeromqleap 15.24.2.3-lp152.7.3.1fixed
Opensuselibunwindleap 15.11.2.1-lp151.4.3.1fixed
Opensusezeromqleap 15.14.2.3-lp151.5.6.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianzeromq3sourcesid4.3.3-1not yet assignedNot reportedNot reported
Debianzeromq3sourceforky4.3.3-1not yet assignedNot reportedNot reported
Debianzeromq3sourcetrixie4.3.3-1not yet assignedNot reportedNot reported
Debianzeromq3sourcebookworm4.3.3-1not yet assignedNot reportedNot reported
Alpinezeromqapk3.104.3.3-r0Not reportedALPINE-CVE-2020-15166Not reported
Alpinezeromqapk3.114.3.3-r0Not reportedALPINE-CVE-2020-15166Not reported
Alpinezeromqapk3.124.3.3-r0Not reportedALPINE-CVE-2020-15166Not reported
Alpinezeromqapk3.134.3.3-r0Not reportedALPINE-CVE-2020-15166Not reported
Alpinezeromqapk3.144.3.3-r0Not reportedALPINE-CVE-2020-15166Not reported
Alpinezeromqapk3.154.3.3-r0Not reportedALPINE-CVE-2020-15166Not reported
Alpinezeromqapk3.164.3.3-r0Not reportedALPINE-CVE-2020-15166Not reported
Alpinezeromqapk3.174.3.3-r0Not reportedALPINE-CVE-2020-15166Not reported
Alpinezeromqapk3.184.3.3-r0Not reportedALPINE-CVE-2020-15166Not reported
Alpinezeromqapk3.194.3.3-r0Not reportedALPINE-CVE-2020-15166Not reported
Alpinezeromqapk3.204.3.3-r0Not reportedALPINE-CVE-2020-15166Not reported
Alpinezeromqapk3.214.3.3-r0Not reportedALPINE-CVE-2020-15166Not reported
Alpinezeromqapk3.224.3.3-r0Not reportedALPINE-CVE-2020-15166Not reported
Alpinezeromqapk3.234.3.3-r0Not reportedALPINE-CVE-2020-15166Not reported
Alpinezeromqapk3.244.3.3-r0Not reportedALPINE-CVE-2020-15166Not reported
Alpinezeromqapk3.94.3.3-r0Not reportedALPINE-CVE-2020-15166Not reported
Ubuntuzeromq3debpro4.3.2-2ubuntu1.20.04.1~esm1Not reportedUBUNTU-CVE-2020-15166Not reported
Suselibunwindrpmlinux enterprise module for basesystem 15 sp11.2.1-4.2.3Not reportedSUSE-SU-2020:3264-1Not reported
Susezeromqrpmlinux enterprise module for basesystem 15 sp14.2.3-3.15.4Not reportedSUSE-SU-2020:3264-1Not reported
Suselibunwindrpmlinux enterprise module for basesystem 15 sp21.2.1-4.2.3Not reportedSUSE-SU-2020:3264-1Not reported
Susezeromqrpmlinux enterprise module for basesystem 15 sp24.2.3-3.15.4Not reportedSUSE-SU-2020:3264-1Not reported
Suselibunwindrpmlinux enterprise module for package hub 15 sp11.2.1-4.2.3Not reportedSUSE-SU-2020:3264-1Not reported
Suselibunwindrpmlinux enterprise module for package hub 15 sp21.2.1-4.2.3Not reportedSUSE-SU-2020:3264-1Not reported
Suselibunwindrpmlinux enterprise high performance computing 15-espos1.2.1-4.2.3Not reportedSUSE-SU-2020:3264-1Not reported
Susezeromqrpmlinux enterprise high performance computing 15-espos4.2.3-3.15.4Not reportedSUSE-SU-2020:3264-1Not reported
Suselibunwindrpmlinux enterprise high performance computing 15-ltss1.2.1-4.2.3Not reportedSUSE-SU-2020:3264-1Not reported
Susezeromqrpmlinux enterprise high performance computing 15-ltss4.2.3-3.15.4Not reportedSUSE-SU-2020:3264-1Not reported
Suselibunwindrpmlinux enterprise server 15-ltss1.2.1-4.2.3Not reportedSUSE-SU-2020:3264-1Not reported
Susezeromqrpmlinux enterprise server 15-ltss4.2.3-3.15.4Not reportedSUSE-SU-2020:3264-1Not reported
Suselibunwindrpmlinux enterprise server for sap applications 151.2.1-4.2.3Not reportedSUSE-SU-2020:3264-1Not reported
Susezeromqrpmlinux enterprise server for sap applications 154.2.3-3.15.4Not reportedSUSE-SU-2020:3264-1Not reported
Opensuselibunwindrpmleap 15.21.2.1-lp152.5.3.1Not reportedOPENSUSE-SU-2020:1910-1Not reported
Opensusezeromqrpmleap 15.24.2.3-lp152.7.3.1Not reportedOPENSUSE-SU-2020:1910-1Not reported
Opensuselibunwindrpmleap 15.11.2.1-lp151.4.3.1Not reportedOPENSUSE-SU-2020:1907-1Not reported
Opensusezeromqrpmleap 15.14.2.3-lp151.5.6.1Not reportedOPENSUSE-SU-2020:1907-1Not reported

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [libzmq3-dev]Fixed

    Source package: [zeromq3]

    Details (2)

    • 4.3.4-6 · amd64 · bookworm

      Fixed · Fixed: 4.3.3-1

      dsa · zeromq3 · debian · bookworm; dsa · zeromq3 · debian · 12

    • 4.3.4-6 · arm64 · bookworm

      Fixed · Fixed: 4.3.3-1

      dsa · zeromq3 · debian · bookworm; dsa · zeromq3 · debian · 12

  • [libzmq5]Fixed

    Source package: [zeromq3]

    Details (2)

    • 4.3.4-6 · amd64 · bookworm

      Fixed · Fixed: 4.3.3-1

      dsa · zeromq3 · debian · bookworm; dsa · zeromq3 · debian · 12

    • 4.3.4-6 · arm64 · bookworm

      Fixed · Fixed: 4.3.3-1

      dsa · zeromq3 · debian · bookworm; dsa · zeromq3 · debian · 12

[Debian 13 (Trixie)]

  • [libzmq3-dev]Fixed

    Source package: [zeromq3]

    Details (2)

    • 4.3.5-1+b3 · amd64 · trixie

      Fixed · Fixed: 4.3.3-1

      dsa · zeromq3 · debian · 13

    • 4.3.5-1+b3 · arm64 · trixie

      Fixed · Fixed: 4.3.3-1

      dsa · zeromq3 · debian · 13

  • [libzmq5]Fixed

    Source package: [zeromq3]

    Details (2)

    • 4.3.5-1+b3 · amd64 · trixie

      Fixed · Fixed: 4.3.3-1

      dsa · zeromq3 · debian · 13

    • 4.3.5-1+b3 · arm64 · trixie

      Fixed · Fixed: 4.3.3-1

      dsa · zeromq3 · debian · 13

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [SUSE security advisories and VEX]