VYPR
← All advisories
Unrated severityNVD Advisory· Published Jul 10, 2019· Updated Aug 4, 2024

CVE-2019-13132

CVE-2019-13132

Description

A buffer overflow in ZeroMQ's CURVE authentication allows remote unauthenticated attackers to cause a stack overflow and potentially execute arbitrary code.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

A buffer overflow in ZeroMQ's CURVE authentication allows remote unauthenticated attackers to cause a stack overflow and potentially execute arbitrary code.

Vulnerability

A buffer overflow exists in the ZeroMQ library (libzmq) when processing CURVE encryption handshakes. The flaw resides in the curve_server.cpp code path that handles incoming client hello messages. A remote, unauthenticated client can send a specially crafted packet that overflows a fixed-size stack buffer, overwriting the stack with attacker-controlled data. All versions from 4.0.0 up to but not including 4.0.9, 4.1.x before 4.1.7, and 4.2.x before 4.3.2 are affected [3].

Exploitation

An attacker needs only network access to a libzmq application that listens with CURVE encryption/authentication enabled. No prior authentication or user interaction is required. The attacker sends a malicious CURVE handshake message that triggers the buffer overflow, allowing them to overwrite the stack with arbitrary data [2][3].

Impact

Successful exploitation results in a stack overflow, which can cause a denial of service (crash) or, with careful crafting, arbitrary code execution at the privilege level of the vulnerable process. The CVSS v3 score is 9.8 (Critical) [2][3].

Mitigation

Upgrade to a fixed version: 4.0.9, 4.1.7, or 4.3.2 (or any later release such as 4.3.5) [1][3]. No workarounds are available; users running public servers with CURVE encryption enabled are strongly advised to upgrade immediately [3].

References
  1. Releases · zeromq/libzmq
  2. How I discovered a 9.8 critical security vulnerability in ZeroMQ with mostly pure luck and my two cents about xz backdoor
  3. security - CVE-2019-13132: zeromq/libzmq: denial of service via stack overflow with arbitrary data

AI Insight generated on May 26, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

19

Patches

3
a84ffa12b2eb

Finalize changelog for 4.3.2

https://github.com/zeromq/libzmqLuca BoccassiJul 2, 2019via osv
commit
1 file changed · +1 −1
  • NEWS+1 −1 modified
    @@ -1,4 +1,4 @@
-0MQ version 4.3.2 stable, released on 20xx/xx/xx
+0MQ version 4.3.2 stable, released on 2019/07/08
 ================================================
 
 * CVE-2019-13132: a remote, unauthenticated client connecting to a
28625e3479a9

Finalize NEWS and ABI revision for 4.0.9

https://github.com/zeromq/libzmqLuca BoccassiJul 2, 2019via osv
commit
2 files changed · +3 −2
  • configure.ac+2 −1 modified
    @@ -31,9 +31,10 @@ AC_SUBST(PACKAGE_VERSION)
 # ZeroMQ version 3.1: 3:0:0 (ABI version 3)
 # ZeroMQ version 4.0: 4:0:0 (ABI version 4)
 # ZeroMQ version 4.0.8: 4:1:0 (ABI version 4)
+# ZeroMQ version 4.0.9: 4:2:0 (ABI version 4)
 #
 # libzmq -version-info current:revision:age
-LTVER="4:1:0"
+LTVER="4:2:0"
 AC_SUBST(LTVER)
 
 # Take a copy of original flags
  • NEWS+1 −1 modified
    @@ -1,4 +1,4 @@
-0MQ version 4.0.9 stable, released on 2016/xx/xx
+0MQ version 4.0.9 stable, released on 2019/07/08
 ================================================
 
 * CVE-2019-13132: a remote, unauthenticated client connecting to a
c9894a493dd4

Finalize NEWS and bump ABI revision for 4.1.7

https://github.com/zeromq/libzmqLuca BoccassiJul 2, 2019via osv
commit
2 files changed · +3 −2
  • configure.ac+2 −1 modified
    @@ -34,9 +34,10 @@ AC_SUBST(PACKAGE_VERSION)
 # ZeroMQ version 4.1: 5:0:0 (ABI version 5)
 # ZeroMQ version 4.1.5: 5:1:0 (ABI version 5)
 # ZeroMQ version 4.1.6: 5:2:0 (ABI version 5)
+# ZeroMQ version 4.1.7: 5:3:0 (ABI version 5)
 #
 # libzmq -version-info current:revision:age
-LTVER="5:2:0"
+LTVER="5:3:0"
 AC_SUBST(LTVER)
 
 # Take a copy of original flags
  • NEWS+1 −1 modified
    @@ -1,4 +1,4 @@
-0MQ version 4.1.7 stable, released on 20xx/xx/xx
+0MQ version 4.1.7 stable, released on 2019/07/08
 ================================================
 
 * CVE-2019-13132: a remote, unauthenticated client connecting to a

Vulnerability mechanics

Generated on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

15

News mentions

0

No linked articles in our index yet.