Critical
Security advisory
In ZeroMQ libzmq before 4.0.9, 4.1.x before 4.1.7, and 4.2.x before 4.3.2, a remote, unauthenticated client connecting to a libzmq application, running with a socket listening with CURVE encryption/authentication enabled, may cause a stack overflow and overwrite the stack with arbitrary data, due to a buffer overflow in the library. Users running public servers with the above configuration are highly encouraged to upgrade as soon as possible, as there are no known mitigations.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2019-13132
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 1 Nov 2026, 08:44 UTC · Revision 1
Source evidence
In ZeroMQ libzmq before 4.0.9, 4.1.x before 4.1.7, and 4.2.x before 4.3.2, a remote, unauthenticated client connecting to a libzmq application, running with a socket listening with CURVE encryption/authentication enabled, may cause a stack overflow and overwrite the stack with arbitrary data, due to a buffer overflow in the library. Users running public servers with the above configuration are highly encouraged to upgrade as soon as possible, as there are no known mitigations.
osv:CVE-2019-13132
Complete source record
{
"id": "728812e4912d5eb34ce96ccb0de3a2abed31f55e410868ccb90cdcc99636a1a7",
"url": "https://osv.dev/vulnerability/CVE-2019-13132",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2019-13132",
"summary": "In ZeroMQ libzmq before 4.0.9, 4.1.x before 4.1.7, and 4.2.x before 4.3.2, a remote, unauthenticated client connecting to a libzmq application, running with a socket listening with CURVE encryption/authentication enabled, may cause a stack overflow and overwrite the stack with arbitrary data, due to a buffer overflow in the library. Users running public servers with the above configuration are highly encouraged to upgrade as soon as possible, as there are no known mitigations.",
"evidence": "osv:CVE-2019-13132",
"products": [],
"severity": "critical",
"structured": {
"id": "CVE-2019-13132",
"aliases": [
"CVE-2019-13132"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/zeromq/libzmq",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "28625e3479a9f568740674655b4cc61dab9404eb"
},
{
"introduced": "3aa5a9d409c9d93fd9a984f6d1221ca596eae659"
},
{
"fixed": "c9894a493dd4a460d6a109a017609925ce589e31"
},
{
"introduced": "097bf26e8dacf73abc2a6cdd6f9e4dce824b8208"
},
{
"fixed": "a84ffa12b2eb3569ced199660bac5ad128bff1f0"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:zeromq:libzmq:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0"
},
{
"fixed": "4.0.9"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:zeromq:libzmq:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "4.1.0"
},
{
"fixed": "4.1.7"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:zeromq:libzmq:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "4.2.0"
},
{
"fixed": "4.3.2"
}
],
"source": "CPE_RANGE"
}
]
}
}
],
"versions": [
"v4.3.1",
"v4.3.0",
"v4.2.5",
"v4.2.4",
"v4.2.3",
"v4.2.2",
"v4.2.1",
"v4.2.0",
"v4.1.6",
"v4.1.5",
"v4.0.8",
"v4.1.4",
"v4.1.3",
"v4.1.2",
"v4.0.7",
"v4.0.6",
"v4.1.1",
"v4.1.0",
"v4.0.5",
"v4.0.4",
"v4.0.3",
"v4.0.2",
"v4.0.1",
"v4.0.0",
"v3.1.0"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-13132.json"
}
},
{
"ranges": [
{
"repo": "https://github.com/zeromq/zeromq4-1",
"type": "GIT",
"events": [
{
"introduced": "3aa5a9d409c9d93fd9a984f6d1221ca596eae659"
},
{
"fixed": "c9894a493dd4a460d6a109a017609925ce589e31"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:zeromq:libzmq:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "4.1.0"
},
{
"fixed": "4.1.7"
}
],
"source": "CPE_RANGE"
}
]
}
}
],
"versions": [
"v4.1.6",
"v4.1.5",
"v4.1.4",
"v4.1.3",
"v4.1.2",
"v4.1.1",
"v4.1.0"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-13132.json"
}
},
{
"ranges": [
{
"repo": "https://github.com/zeromq/zeromq4-x",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "28625e3479a9f568740674655b4cc61dab9404eb"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:zeromq:libzmq:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0"
},
{
"fixed": "4.0.9"
}
],
"source": "CPE_RANGE"
}
]
}
}
],
"versions": [
"v4.0.8",
"v4.0.7",
"v4.0.6",
"v4.0.5",
"v4.0.4",
"v4.0.3",
"v4.0.2",
"v4.0.1",
"v4.0.0"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-13132.json"
}
}
],
"modified": "2026-10-24T10:49:50.037394173Z",
"provider": "osv",
"references": [
"https://fangpenlin.com/posts/2024/04/07/how-i-discovered-a-9-point-8-critical-security-vulnerability-in-zeromq-with-mostly-pure-luck/",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AVCTNUEOFFZUNJOXFCYCF3C6Y6NDILI3/",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MK7SJYDJ7MMRRRPCUN3SCSE7YK6ZSHVS/",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T6HINI24SL7CU6XIJWUOSGTZWEFOOL7X/",
"https://news.ycombinator.com/item?id=39970716",
"https://github.com/zeromq/libzmq/issues/3558",
"https://github.com/zeromq/libzmq/releases",
"https://lists.debian.org/debian-lts-announce/2019/07/msg00007.html",
"https://seclists.org/bugtraq/2019/Jul/13",
"https://security.gentoo.org/glsa/201908-17",
"https://usn.ubuntu.com/4050-1/",
"https://www.debian.org/security/2019/dsa-4477"
],
"provider_metadata": {
"unresolved_ranges": [
{
"cpes": [
"cpe:2.3:a:zeromq:libzmq:*:*:*:*:*:*:*:*"
],
"vendor_product": "zeromq:libzmq",
"extracted_events": [
{
"range": [
{
"fixed": "4.0.9"
},
{
"introduced": "4.1.0"
},
{
"fixed": "4.1.7"
},
{
"introduced": "4.2.0"
},
{
"fixed": "4.3.2"
},
{
"introduced": "4.2.0"
},
{
"fixed": "4.3.2"
}
],
"source": "CPE_RANGE"
}
]
},
{
"cpes": [
"cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*",
"cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*",
"cpe:2.3:o:canonical:ubuntu_linux:18.10:*:*:*:*:*:*:*",
"cpe:2.3:o:canonical:ubuntu_linux:19.04:*:*:*:*:*:*:*"
],
"vendor_product": "canonical:ubuntu_linux",
"extracted_events": [
{
"range": [
{
"introduced": "16.04"
},
{
"last_affected": "16.04"
},
{
"introduced": "18.04"
},
{
"last_affected": "18.04"
},
{
"introduced": "18.10"
},
{
"last_affected": "18.10"
},
{
"introduced": "19.04"
},
{
"last_affected": "19.04"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*",
"cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*"
],
"vendor_product": "debian:debian_linux",
"extracted_events": [
{
"range": [
{
"introduced": "8.0"
},
{
"last_affected": "8.0"
},
{
"introduced": "9.0"
},
{
"last_affected": "9.0"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:o:fedoraproject:fedora:29:*:*:*:*:*:*:*",
"cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:*",
"cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*"
],
"vendor_product": "fedoraproject:fedora",
"extracted_events": [
{
"range": [
{
"introduced": "29"
},
{
"last_affected": "29"
},
{
"introduced": "30"
},
{
"last_affected": "30"
},
{
"introduced": "31"
},
{
"last_affected": "31"
}
],
"source": "CPE_STRING"
}
]
}
]
}
},
"related_cves": [
{
"value": "CVE-2019-13132",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 441849,
"published_at": "2019-07-10T19:15:10.517+00:00"
}