← Vulnerability feed

Vulnerability record · CVE-2020-36400 · published 1 July 2021

CVE-2020-36400: Zeromq libzmq out-of-bounds write vulnerability

Zeromq · Libzmq

ZeroMQ libzmq 4.3.3 has a heap-based buffer overflow in zmq::tcp_read, a different vulnerability than CVE-2021-20235.

9.8 CVSS 3.1 Critical EPSS 1.8% · top 21.8% CWE-787 · Out-of-bounds write
9.8CVSS 3.1 base score, v2 7.5
1.8%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
6References
17 Jun 2026Last modified by NVD

Description

ZeroMQ libzmq 4.3.3 has a heap-based buffer overflow in zmq::tcp_read, a different vulnerability than CVE-2021-20235.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=26042 Issue TrackingMailing ListPatchThird Party Advisory
https://github.com/google/oss-fuzz-vulns/blob/main/vulns/libzmq/OSV-2020-1887.yaml Third Party Advisory
https://github.com/zeromq/libzmq/commit/397ac80850bf8d010fae23dd215db0ee2c677306 PatchThird Party Advisory
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=26042 Issue TrackingMailing ListPatchThird Party Advisory
https://github.com/google/oss-fuzz-vulns/blob/main/vulns/libzmq/OSV-2020-1887.yaml Third Party Advisory
https://github.com/zeromq/libzmq/commit/397ac80850bf8d010fae23dd215db0ee2c677306 PatchThird Party Advisory

Track CVE-2020-36400 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2019-13132Zeromq libzmq out-of-bounds write vulnerabilityIn ZeroMQ libzmq before 4.0.9, 4.1.x before 4.1.7, and 4.2.x before 4.3.2, a remote, unauthenticated client connecting to a libzmq application, runni…EPSS 42%8.8CVE-2019-6250Zeromq libzmq integer overflow vulnerabilityA pointer overflow, with code execution, was discovered in ZeroMQ libzmq (aka 0MQ) 4.2.x and 4.3.x before 4.3.1. A v2_decoder.cpp zmq::v2_decoder_t::…EPSS 9.4%8.1CVE-2021-20235Zeromq libzmq classic buffer overflow vulnerabilityThere's a flaw in the zeromq server in versions before 4.3.3 in src/decoder_allocators.hpp. The decoder static allocator could have its sized changed…EPSS 44%7.5CVE-2021-20237Zeromq libzmq uncontrolled resource consumption vulnerabilityAn uncontrolled resource consumption (memory leak) flaw was found in ZeroMQ's src/xpub.cpp in versions before 4.3.3. This flaw allows a remote unauth…EPSS 1.7%7.5CVE-2020-15166Zeromq libzmq uncontrolled resource consumption vulnerabilityIn ZeroMQ before version 4.3.3, there is a denial-of-service vulnerability. Users with TCP transport public endpoints, even with CURVE/ZAP enabled, a…EPSS 3.4%6.5CVE-2021-20234Zeromq libzmq uncontrolled resource consumption vulnerabilityAn uncontrolled resource consumption (memory leak) flaw was found in the ZeroMQ client in versions before 4.3.3 in src/pipe.cpp. This issue causes a …EPSS 1.1%8.8CVE-2026-53266Linux kernel ebtables SNAT out-of-bounds write in ARP rewriteThe ebtables SNAT target rewrites the ARP sender hardware address via skb_store_bits() without first making that range writable. When the ARP SHA byt…KEVEPSS 0.65%analysed8.8CVE-2026-87491Google Chrome V8 out-of-bounds write enables sandbox code executionChrome before 153.0.8010.36 contains an out-of-bounds write in the V8 JavaScript engine. A crafted HTML page can trigger the memory corruption, and b…KEVEPSS 3.1%analysed

Source: NIST National Vulnerability Database (record CVE-2020-36400), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.