EUVD-2026-42597
GHSA-r3q8-ccf6-4xhj
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Remote, unauthenticated, low-complexity triggering of the FTP analyzer with no user interaction; impact is availability only (sensor crash), so C:N/I:N/A:H.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
Zeek before 8.0.9 contains an uncontrolled memory consumption vulnerability in the FTP analyzer that allows unauthenticated remote attackers to cause process termination by sending a crafted FTP control session negotiating AUTH GSSAPI followed by a large ADAT control line. Attackers can exploit the NVT_Analyzer component's lack of a maximum line length check, causing it to continuously double its internal buffer without bounds during base64 decoding of an attacker-controlled ADAT token, resulting in denial of service of the Zeek sensor.
AnalysisAI
Denial of service in Zeek network security monitor (versions before 8.0.9) lets unauthenticated remote attackers crash the sensor by driving unbounded memory growth in the FTP protocol analyzer. By opening an FTP control session, negotiating AUTH GSSAPI, and sending an oversized ADAT control line, an attacker forces the NVT_Analyzer to repeatedly double its base64-decode buffer until the process is terminated. VulnCheck reported the issue; there is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the network-facing, unauthenticated, low-complexity nature makes it a high-availability risk for exposed monitoring infrastructure.
Technical ContextAI
Zeek (formerly Bro) is an open-source network security monitoring and traffic-analysis platform whose protocol analyzers passively reconstruct application-layer sessions from observed traffic. The flaw lives in the FTP analyzer path, specifically the NVT (Network Virtual Terminal) line handling used to read FTP control-channel commands. During the RFC 2228 AUTH GSSAPI security exchange, the ADAT command carries a base64-encoded authentication token; Zeek's NVT_Analyzer buffers this control line but omits any maximum-line-length check, so as the attacker-supplied ADAT token grows, the internal buffer is repeatedly doubled without an upper bound while decoding. This maps to CWE-770 (Allocation of Resources Without Limits or Throttling): the root cause is unthrottled, attacker-controlled memory allocation driven directly by input size. The affected CPE is cpe:2.3:a:zeek:zeek:*, i.e. the Zeek application itself across versions prior to 8.0.9.
RemediationAI
Vendor-released patch: upgrade to Zeek 8.0.9 or later, which adds the missing maximum-line-length bound in the FTP/NVT analyzer (release https://github.com/zeek/zeek/releases/tag/v8.0.9, fix commit https://github.com/zeek/zeek/commit/93ff6950a90cfa9d00c1062cde429313a0402a01; advisory https://www.vulncheck.com/advisories/zeek-uncontrolled-memory-consumption-dos-via-ftp-analyzer). Where immediate patching is not possible, disable or unload the FTP analyzer (for example remove/disable the FTP protocol analysis scripts or use Zeek's analyzer-disable mechanism for the FTP analyzer) to remove the vulnerable code path - the trade-off is loss of FTP visibility in your monitoring. As a further compensating control, constrain which traffic reaches the sensor so that attacker-controlled FTP control sessions cannot be freely presented to the analyzer, and monitor Zeek process memory/restart behavior (e.g. via ZeekControl/systemd watchdog and automatic restart) so a crash triggers alerting and rapid recovery rather than a silent monitoring gap; note that auto-restart mitigates downtime but does not stop a persistent attacker from repeatedly re-triggering the crash.
An issue was discovered in zeek version 4.1.0. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitabl
Denial of service in Zeek (formerly Bro) network security monitor before 8.0.9 lets remote unauthenticated attackers cra
In Zeek Network Security Monitor (formerly known as Bro) before 2.6.2, a NULL pointer dereference in the Kerberos (aka K
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today