CVE-2014-9721
libzmq before 4.0.6 and 4.1.x before 4.1.1 allows remote attackers to conduct downgrade attacks...
libzmq before 4.0.6 and 4.1.x before 4.1.1 allows remote attackers to conduct downgrade attacks and bypass ZMTP v3 protocol security mechanisms via a ZMTP v2 or earlier header.
Exploit likelihood
What each source reports
NVD Score used
libzmq before 4.0.6 and 4.1.x before 4.1.1 allows remote attackers to conduct downgrade attacks and bypass ZMTP v3 protocol security mechanisms via a ZMTP v2 or earlier header.
- Record
CVE-2014-9721- CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:P/A:N - Weakness
- CWE-20
- Updated
- 2026-11-02
CVE List No score
libzmq before 4.0.6 and 4.1.x before 4.1.1 allows remote attackers to conduct downgrade attacks and bypass ZMTP v3 protocol security mechanisms via a ZMTP v2 or earlier header.
- Record
CVE-2014-9721- Updated
- 2026-11-02
EUVDEUVD-2014-9527 No score
libzmq before 4.0.6 and 4.1.x before 4.1.1 allows remote attackers to conduct downgrade attacks and bypass ZMTP v3 protocol security mechanisms via a ZMTP v2 or earlier header.
- Record
EUVD-2014-9527- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-cx82-pq93-6p39 No score
libzmq before 4.0.6 and 4.1.x before 4.1.1 allows remote attackers to conduct downgrade attacks...
libzmq before 4.0.6 and 4.1.x before 4.1.1 allows remote attackers to conduct downgrade attacks and bypass ZMTP v3 protocol security mechanisms via a ZMTP v2 or earlier header.
- Record
GHSA-cx82-pq93-6p39- Weakness
- CWE-20
- Updated
- 2026-11-02
OSV No score
libzmq before 4.0.6 and 4.1.x before 4.1.1 allows remote attackers to conduct downgrade attacks and bypass ZMTP v3 protocol security mechanisms via a ZMTP v2 or earlier header.
- Record
CVE-2014-9721- Updated
- 2026-11-02
OSVDEBIAN-CVE-2014-9721 No score
libzmq before 4.0.6 and 4.1.x before 4.1.1 allows remote attackers to conduct downgrade attacks and bypass ZMTP v3 protocol security mechanisms via a ZMTP v2 or earlier header.
- Record
DEBIAN-CVE-2014-9721- Updated
- 2026-11-02
Show 5 moreShow less
OSVopenSUSE-SU-2024:10038-1 No score
libzmq5-4.2.0-1.1 on GA media
These are all security issues fixed in the libzmq5-4.2.0-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10038-1- Updated
- 2026-11-02
OSVSUSE-FU-2022:0444-1 No score
Feature update for venv-salt-minion
This feature update for venv-salt-minion provides the following changes:
- Introduce
venv-salt-minion. - Track already fixed issues.
- Record
SUSE-FU-2022:0444-1- Updated
- 2026-11-02
OSVSUSE-FU-2022:0445-1 No score
Feature update for venv-salt-minion
This feature update for venv-salt-minion provides the following changes:
- Introduce
venv-salt-minion. - Mention fixed issues provided with the bundle.
- Record
SUSE-FU-2022:0445-1- Updated
- 2026-11-02
OSVSUSE-SU-2015:1510-1 No score
Security update for zeromq
zeromq was updated to fix one security issue and one non-security bug.
The following vulnerability was fixed:
- CVE-2014-9721: zeromq protocol downgrade attack on sockets using the ZMTP v3 protocol (boo#931978)
The following bug was fixed:
- boo#912460: avoid curve test to hang for ppc ppc64 ppc64le architectures
- Record
SUSE-SU-2015:1510-1- Updated
- 2026-11-02
OSVUBUNTU-CVE-2014-9721 No score
libzmq before 4.0.6 and 4.1.x before 4.1.1 allows remote attackers to conduct downgrade attacks and bypass ZMTP v3 protocol security mechanisms via a ZMTP v2 or earlier header.
- Record
UBUNTU-CVE-2014-9721- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
zeromq3Debian:12 |
before 4.0.5+dfsg-3 | 4.0.5+dfsg-3 |
zeromq3Debian:13 |
before 4.0.5+dfsg-3 | 4.0.5+dfsg-3 |
zeromq3Debian:14 |
before 4.0.5+dfsg-3 | 4.0.5+dfsg-3 |
zeromq3Debian:8 |
before 4.0.5+dfsg-2+deb8u1, plus listed versions 4.0.5+dfsg-2 |
4.0.5+dfsg-2+deb8u1 |
zeromqSUSE:Linux Enterprise Desktop 12 |
before 4.0.4-13.1 | 4.0.4-13.1 |
zeromqSUSE:Linux Enterprise Software Development Kit 12 |
before 4.0.4-13.1 | 4.0.4-13.1 |
zeromqSUSE:Linux Enterprise Workstation Extension 12 |
before 4.0.4-13.1 | 4.0.4-13.1 |
zeromqSUSE:Enterprise Storage 1.0 |
before 4.0.4-13.1 | 4.0.4-13.1 |
zeromq3Ubuntu:14.04:LTS |
before 4.0.4+dfsg-2ubuntu0.1, plus listed versions 3.2.3+dfsg-23.2.4+dfsg-13.2.4+dfsg-23.2.4+dfsg-33.2.4+dfsg-44.0.3+dfsg-14.0.4+dfsg-2 |
4.0.4+dfsg-2ubuntu0.1 |
zeromqopenSUSE:Tumbleweed From an advisory covering 3 CVEs |
before 4.2.0-1.1 | 4.2.0-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2014-9721 is a medium vulnerability (CVSS 4.3) in Zeromq, published May 10, 2015. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.51%, the 84th percentile. Fixed in zeromq3 4.0.5+dfsg-3.
References
github.com/zeromq/zeromq4-x/commit/b6e3e0f601e2c1ec1f3aac880ed6a3fe63043e51
debian.org/security/2015/dsa-3255
lists.fedoraproject.org/pipermail/package-announce/2015-May/159176.html
lists.opensuse.org/opensuse-updates/2015-06/msg00018.html
nvd.nist.gov/vuln/detail/CVE-2014-9721
Show 194 moreShow less
security-tracker.debian.org/tracker/CVE-2014-9721
suse.com/support/update/announcement/-2022-444/suse-fu-20220444-1
bugzilla.suse.com/1000080
ubuntu.com/security/CVE-2014-9721
openwall.com/lists/oss-security/2015/05/07/8
cve.org/CVERecord?id=CVE-2014-9721
Left out here: 479 references. The JSON record has them.