EUVD-2026-42598
GHSA-76hq-67jv-x5j7
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable single packet with no auth or interaction (AV:N/AC:L/PR:N/UI:N); impact is sensor crash only, so C:N/I:N/A:H and scope unchanged.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
1DescriptionCVE.org
Zeek before 8.0.9 contains a null pointer dereference vulnerability in its Kerberos protocol analyzer that allows unauthenticated remote attackers to crash the sensor by sending a crafted KRB_ERROR message with error-code 25 (KDC_ERR_PREAUTH_REQUIRED) containing a PA-DATA element with padata-type 2, 3, 11, or 19. Attackers can exploit a parser and analyzer state mismatch where proc_padata() dereferences an uninitialized pa_data_element field selected by the wrong parsing arm, triggering a crash via a single UDP or TCP packet to port 88 without any credentials or prior authentication.
AnalysisAI
Denial of service in Zeek (formerly Bro) network security monitor before 8.0.9 lets remote unauthenticated attackers crash the sensor by sending a single crafted Kerberos KRB_ERROR packet. The flaw is a null pointer dereference (CWE-476) in the Kerberos analyzer's proc_padata() routine, reachable over UDP or TCP port 88 with no credentials. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the trivial single-packet trigger and passive-monitoring exposure make it operationally significant for security teams running Zeek inline or on tapped traffic.
Technical ContextAI
Zeek is an open-source network security monitor that passively parses protocol traffic to generate security telemetry; the affected component is its Kerberos protocol analyzer, which decodes KRB messages seen on the wire (Kerberos default port 88). The root cause is CWE-476 (NULL pointer dereference) arising from a parser/analyzer state mismatch: when a KRB_ERROR message carries error-code 25 (KDC_ERR_PREAUTH_REQUIRED) with a PA-DATA element of padata-type 2, 3, 11, or 19, proc_padata() dereferences an uninitialized pa_data_element field that was selected by the wrong parsing arm. Because Zeek analyzes traffic it observes rather than traffic addressed to it, any Kerberos error traffic traversing a monitored segment can reach this code path. The single affected product per CPE is cpe:2.3:a:zeek:zeek covering all versions prior to 8.0.9.
RemediationAI
Vendor-released patch: 8.0.9 - upgrade Zeek to v8.0.9 or later (release: https://github.com/zeek/zeek/releases/tag/v8.0.9; fix commit c82e3c734893d932e94310aec0dbeb1ffcea169d). If immediate upgrade is not possible, the most direct compensating control is to disable the Kerberos analyzer (e.g., unload/disable the KRB protocol analyzer in local.zeek) so the vulnerable proc_padata() path is never reached; the trade-off is loss of all Kerberos protocol visibility and detections. Alternatively, exclude or filter Kerberos traffic (port 88 UDP/TCP) from the analyzed feed via the capture filter or an upstream BPF, accepting the same Kerberos blind spot. Because Zeek passively inspects observed traffic, network ACLs on the sensor host will not help - the mitigation must remove Kerberos parsing or Kerberos packets from what Zeek analyzes. Refer to the VulnCheck advisory (https://www.vulncheck.com/advisories/zeek-null-pointer-dereference-dos-via-kerberos-krb-error-parsing) for details.
An issue was discovered in zeek version 4.1.0. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitabl
Denial of service in Zeek network security monitor (versions before 8.0.9) lets unauthenticated remote attackers crash t
In Zeek Network Security Monitor (formerly known as Bro) before 2.6.2, a NULL pointer dereference in the Kerberos (aka K
Same weakness CWE-476 – NULL Pointer Dereference
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today