CVE-2021-20235

There’s a flaw in the zeromq server in versions before 4.3.3 in
src/decoder_allocators.hpp. The decoder static allocator could have its
sized changed, but the buffer would remain the same as it is a static
buffer. A remote, unauthenticated attacker who sends a crafted request to
the zeromq server could trigger a buffer overflow WRITE of arbitrary data
if CURVE/ZAP authentication is not enabled. The greatest impact of this
flaw is to application availability, data integrity, and confidentiality.

Bugs

• <https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=21984&gt;