CVE catalog

CVE-2021-20236

zeromq3 affected and fixed versions

A flaw was found in the ZeroMQ server in versions before 4.3.3. This flaw allows a malicious client to cause a stack buffer overflow on the server by sending crafted topic subscription requests and then unsubscribing. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.

Severity: High · CVSS 7.5CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Published: Jan 1, 2021, 12:00:00 AM UTC
Source: [NVD] · [CVE record]
EPSS: 1.87% · Oct 27, 2026

Projects and upstream resources

[zeromq3][Source-reported homepage]

Reported versions and fixes

Each observation applies to its named package, distribution, and release. Distribution backports can fix a vulnerability while retaining an older upstream version number.

Distribution / release	Package	Version	Status	Source
Debiantrixie	zeromq3	`4.3.3-1`	FixedDistribution-reported fixed boundary	[CVE-2021-20236]
Debiantrixie	zeromq3	`4.3.5-1`	Fixed	[CVE-2021-20236]
Debiansid	zeromq3	`4.3.3-1`	FixedDistribution-reported fixed boundary	[CVE-2021-20236]
Debiansid	zeromq3	`4.3.5-1`	Fixed	[CVE-2021-20236]
Debianforky	zeromq3	`4.3.3-1`	FixedDistribution-reported fixed boundary	[CVE-2021-20236]
Debianforky	zeromq3	`4.3.5-1`	Fixed	[CVE-2021-20236]
Debianbookworm	zeromq3	`4.3.3-1`	FixedDistribution-reported fixed boundary	[CVE-2021-20236]
Debianbookworm	zeromq3	`4.3.4-6`	Fixed	[CVE-2021-20236]

Showing 8 fix observations. All 13 observations, including unknown and conflicting reports, are available below.

Provider details and historical evidence

Distribution / release	Package	Version	Status	Source
Debianbookworm	zeromq3	`4.3.3-1`	FixedDistribution-reported fixed boundary	[CVE-2021-20236]
Debianbookworm	zeromq3	`4.3.4-6`	Fixed	[CVE-2021-20236]
Debianforky	zeromq3	`4.3.3-1`	FixedDistribution-reported fixed boundary	[CVE-2021-20236]
Debianforky	zeromq3	`4.3.5-1`	Fixed	[CVE-2021-20236]
Debiansid	zeromq3	`4.3.3-1`	FixedDistribution-reported fixed boundary	[CVE-2021-20236]
Debiansid	zeromq3	`4.3.5-1`	Fixed	[CVE-2021-20236]
Debiantrixie	zeromq3	`4.3.3-1`	FixedDistribution-reported fixed boundary	[CVE-2021-20236]
Debiantrixie	zeromq3	`4.3.5-1`	Fixed	[CVE-2021-20236]
Ubuntupro	zeromq3	`4.3.2-1`	UnknownSource applicability is not established	[UBUNTU-CVE-2021-20236]Apr 22, 2026, 12:45:34 PM UTC
Ubuntupro	zeromq3	`4.3.2-2`	UnknownSource applicability is not established	[UBUNTU-CVE-2021-20236]Apr 22, 2026, 12:45:34 PM UTC
Ubuntupro	zeromq3	`4.3.2-2ubuntu1`	UnknownSource applicability is not established	[UBUNTU-CVE-2021-20236]Apr 22, 2026, 12:45:34 PM UTC
Ubuntupro	zeromq3	`4.3.2-2ubuntu1.20.04.1~esm1`	UnknownSource applicability is not established	[UBUNTU-CVE-2021-20236]Apr 22, 2026, 12:45:34 PM UTC
Ubuntupro	zeromq3	`4.3.2-2ubuntu1.20.04.1~esm2`	UnknownSource applicability is not established	[UBUNTU-CVE-2021-20236]Apr 22, 2026, 12:45:34 PM UTC

Original provider fields

{
  "package_releases": [
    {
      "name": "zeromq3",
      "status": "fixed",
      "release": "sid",
      "version": "4.3.5-1"
    },
    {
      "name": "zeromq3",
      "status": "fixed",
      "release": "forky",
      "version": "4.3.5-1"
    },
    {
      "name": "zeromq3",
      "status": "fixed",
      "release": "trixie",
      "version": "4.3.5-1"
    },
    {
      "name": "zeromq3",
      "status": "fixed",
      "release": "bookworm",
      "version": "4.3.4-6"
    }
  ],
  "fixed_versions": [
    {
      "bug": null,
      "name": "zeromq3",
      "type": "source",
      "origin": null,
      "release": "sid",
      "urgency": "not yet assigned",
      "fixed_version": "4.3.3-1"
    },
    {
      "bug": null,
      "name": "zeromq3",
      "type": "source",
      "origin": null,
      "release": "forky",
      "urgency": "not yet assigned",
      "fixed_version": "4.3.3-1"
    },
    {
      "bug": null,
      "name": "zeromq3",
      "type": "source",
      "origin": null,
      "release": "trixie",
      "urgency": "not yet assigned",
      "fixed_version": "4.3.3-1"
    },
    {
      "bug": null,
      "name": "zeromq3",
      "type": "source",
      "origin": null,
      "release": "bookworm",
      "urgency": "not yet assigned",
      "fixed_version": "4.3.3-1"
    }
  ],
  "distribution_packages": [
    {
      "name": "zeromq3",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            }
          ]
        }
      ],
      "release": "pro",
      "versions": [
        "4.3.2-1",
        "4.3.2-2",
        "4.3.2-2ubuntu1",
        "4.3.2-2ubuntu1.20.04.1~esm1",
        "4.3.2-2ubuntu1.20.04.1~esm2"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2021-20236",
      "fixed_version": "",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2021-20236",
      "provider_updated_at": "2026-04-22T12:45:34.260069Z",
      "applicability_unknown": true
    }
  ]
}

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

[Debian 12 (Bookworm)]

[libzmq3-dev]Unknown
Source package: [zeromq3]
Details (2)
- 4.3.4-6 · amd64 · bookworm
  Fixed · Fixed: 4.3.3-1
  dsa · zeromq3 · debian · bookworm; dsa · zeromq3 · debian · 12
- 4.3.4-6 · arm64 · bookworm
  Fixed · Fixed: 4.3.3-1
  dsa · zeromq3 · debian · bookworm; dsa · zeromq3 · debian · 12
[libzmq5]Unknown
Source package: [zeromq3]
Details (2)
- 4.3.4-6 · amd64 · bookworm
  Fixed · Fixed: 4.3.3-1
  dsa · zeromq3 · debian · bookworm; dsa · zeromq3 · debian · 12
- 4.3.4-6 · arm64 · bookworm
  Fixed · Fixed: 4.3.3-1
  dsa · zeromq3 · debian · bookworm; dsa · zeromq3 · debian · 12

[Debian 13 (Trixie)]

[libzmq3-dev]Unknown
Source package: [zeromq3]
Details (2)
- 4.3.5-1+b3 · amd64 · trixie
  Fixed · Fixed: 4.3.3-1
  dsa · zeromq3 · debian · 13
- 4.3.5-1+b3 · arm64 · trixie
  Fixed · Fixed: 4.3.3-1
  dsa · zeromq3 · debian · 13
[libzmq5]Unknown
Source package: [zeromq3]
Details (2)
- 4.3.5-1+b3 · amd64 · trixie
  Fixed · Fixed: 4.3.3-1
  dsa · zeromq3 · debian · 13
- 4.3.5-1+b3 · arm64 · trixie
  Fixed · Fixed: 4.3.3-1
  dsa · zeromq3 · debian · 13

Observed: Oct 23, 2026, 5:54:12 PM UTC

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX]