Zeek CVE-2026-60108

Exploitation requires that a Zeek sensor observe an FTP control session in which the attacker negotiates the RFC 2228 AUTH GSSAPI security mechanism and then sends an oversized ADAT control line containing a large attacker-controlled base64 token; the FTP analyzer must be enabled (default) and the traffic must reach the analyzer. Per CVSS AV:N/AC:L/AT:N/PR:N/UI:N there is no authentication, no user interaction, and no special attack requirement - remote unauthenticated triggering against default Zeek configurations prior to 8.0.9. The main limiting factor is exposure: the attacker must be able to cause FTP-shaped control traffic to traverse a network segment Zeek is monitoring, and the FTP analyzer must not have been disabled; impact is limited to availability (sensor crash), with no confidentiality or integrity effect.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N, base 8.7) cleanly matches the description: fully remote, unauthenticated, low complexity, no user interaction, with impact confined to availability - no confidentiality or integrity loss. This is a pure DoS, so despite the high score the practical impact is loss of the monitoring sensor rather than data compromise or code execution. No EPSS score was provided in the input, and the issue is not in CISA KEV, so there is no evidence of active exploitation; it is also not marked as having public POC code, so treat exploitation status as no public exploit identified at time of analysis. The key risk nuance: because Zeek is often deployed inline/adjacent to production traffic as a security sensor, crashing it creates a monitoring blind spot that a more serious attack could hide behind, which raises real-world priority above a generic availability bug even though the direct technical impact is limited. The signals are internally consistent - no conflicting attack-vector vs. access-level indicators - so confidence in the risk shape is good; the main missing signal is EPSS/exploitation probability.

An attacker who can get FTP control traffic observed by a Zeek sensor (for example by connecting to an FTP service, or generating FTP-shaped traffic across a monitored segment) opens a control session, issues AUTH GSSAPI, and then sends an ADAT command with an extremely large base64 token. Zeek's FTP/NVT analyzer keeps doubling its decode buffer for the oversized line until the Zeek process exhausts memory and is terminated, blinding the sensor. No authentication or user interaction is required, and the low attack complexity means the crash is reliably reproducible; no public exploit code has been identified at time of analysis.