CVE-2026-60108
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk35th percentile - higher than 35% of all known CVEs
Summary
A vulnerability in the FTP analyzer of Zeek before version 8.0.9 allows unauthenticated remote attackers to cause process termination by sending a crafted FTP control session negotiating AUTH GSSAPI followed by a large ADAT control line. The NVT_Analyzer component lacks a maximum line length check, causing uncontrolled memory consumption during base64 decoding of an attacker-controlled ADAT token, resulting in denial of service of the Zeek sensor.
Risk Assessment
The risk is that an unauthenticated attacker can remotely crash the Zeek sensor, leading to disruption of network traffic monitoring and loss of visibility in the IT infrastructure.
Recommendation
Immediately upgrade Zeek to version 8.0.9 or later, which includes a fix for this vulnerability.
Other vulnerabilities in Zeek
Original NVD description (English source)
Zeek before 8.0.9 contains an uncontrolled memory consumption vulnerability in the FTP analyzer that allows unauthenticated remote attackers to cause process termination by sending a crafted FTP control session negotiating AUTH GSSAPI followed by a large ADAT control line. Attackers can exploit the NVT_Analyzer component's lack of a maximum line length check, causing it to continuously double its internal buffer without bounds during base64 decoding of an attacker-controlled ADAT token, resulting in denial of service of the Zeek sensor.