CVE-2026-60109

HighCVSS 7.5

Published: 09/07/2026(UTC)Updated: 14/07/2026(UTC)Translated: 15/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.50%

40th percentile - higher than 40% of all known CVEs

Summary

A null pointer dereference vulnerability exists in Zeek before 8.0.9 in its Kerberos protocol analyzer. An unauthenticated remote attacker can crash the sensor by sending a crafted KRB_ERROR message with error code 25 (KDC_ERR_PREAUTH_REQUIRED) containing a PA-DATA element with padata-type 2, 3, 11, or 19.

Risk Assessment

An attacker can remotely crash the Zeek sensor without authentication, causing loss of network monitoring and visibility. A single UDP or TCP packet to port 88 is sufficient.

Recommendation

Upgrade Zeek to version 8.0.9 or later immediately. If upgrading is not possible, consider temporarily disabling the Kerberos analyzer or filtering traffic on port 88.

Other vulnerabilities in Zeek

CVE-2026-60108High
A vulnerability in the FTP analyzer of Zeek before version 8.0.9 allows unauthenticated remote attackers to cause process termination by sending a crafted FTP control session negotiating AUTH GSSAPI followed by a large ADAT control line. The NVT_Analyzer component lacks a maximum line length check, causing uncontrolled memory consumption during base64 decoding of an attacker-controlled ADAT token, resulting in denial of service of the Zeek sensor.

Original NVD description (English source)

Zeek before 8.0.9 contains a null pointer dereference vulnerability in its Kerberos protocol analyzer that allows unauthenticated remote attackers to crash the sensor by sending a crafted KRB_ERROR message with error-code 25 (KDC_ERR_PREAUTH_REQUIRED) containing a PA-DATA element with padata-type 2, 3, 11, or 19. Attackers can exploit a parser and analyzer state mismatch where proc_padata() dereferences an uninitialized pa_data_element field selected by the wrong parsing arm, triggering a crash via a single UDP or TCP packet to port 88 without any credentials or prior authentication.