CVE-2019-13132: In ZeroMQ libzmq before 4.0.9, 4.1.x before 4.1.7, and 4.2.x before 4.3.2, a remote, unauthenticated client...

Security readout for executives and security teams

This flaw affects ZeroMQ libzmq servers using CURVE encryption/authentication on listening sockets. A remote unauthenticated client could crash the application through stack overflow memory corruption. Sources urge upgrading quickly, especially for public servers, and state no known mitigations were available. Exposure is most likely in applications or services embedding affected libzmq/zeromq3 versions and accepting untrusted or public client connections with CURVE enabled. Systems without CURVE-enabled listening sockets are not described as affected by the provided sources. Treat this as high priority for exposed ZeroMQ services using CURVE. The business risk is service disruption from unauthenticated remote clients, with memory corruption characteristics that justify rapid patching even without confirmed active exploitation. Mitigation focus: Upgrade libzmq to 4.0.9, 4.1.7, 4.3.2, or later as applicable.; Apply vendor security updates for zeromq3/libzmq from your Linux distribution.; Prioritize internet-facing services using CURVE-enabled ZeroMQ listener sockets..

Prepared

Jun 6, 2026, 20:22 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.