CVE-2021-20237: 
ZeroMQ vulnerability analysis and mitigation

An uncontrolled resource consumption (memory leak) vulnerability (CVE-2021-20237) was discovered in ZeroMQ's src/xpub.cpp affecting versions before 4.3.3. The vulnerability was discovered in December 2020 and publicly disclosed in May 2021. This flaw affects the ZeroMQ messaging library, specifically impacting systems where CURVE/ZAP authentication is disabled on the server (NVD, GitHub Advisory).

The vulnerability stems from a memory leak in the PUB socket implementation where messages with metadata are never processed but remain referenced in the PUB object without being freed. The issue has a CVSS v3.1 base score of 7.5 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. The vulnerability is classified under CWE-401 (Missing Release of Memory after Effective Lifetime) and CWE-400 (Uncontrolled Resource Consumption) (NVD, Red Hat Bugzilla).

The vulnerability allows remote unauthenticated attackers to send crafted PUB messages that consume excessive memory on the server, potentially leading to a denial of service condition. The primary impact is on system availability, with no direct effect on confidentiality or integrity (NVD).

The vulnerability can be exploited by sending specially crafted PUB messages to servers with disabled CURVE/ZAP authentication. A proof-of-concept test case was identified through OSS-Fuzz that demonstrates the memory leak (GitHub Advisory).

The vulnerability was patched in ZeroMQ version 4.3.3. Users are advised to upgrade to this version or later. No effective workarounds are available other than upgrading to the patched version (GitHub Advisory).