CVE-2026-60108: Zeek FTP Analyzer Denial of Service Vulnerability

Technical summary

The vulnerability exists in Zeek's NVT_Analyzer component, which handles FTP control session parsing. When processing an AUTH GSSAPI negotiation followed by a large ADAT (Authentication Data) control line, the analyzer lacks bounds checking on buffer expansion during base64 decoding of the attacker-controlled token. The internal buffer doubles repeatedly without a maximum length limit, consuming memory until the Zeek process is terminated. This is classified as CWE-770 (Uncontrolled Allocation of Resources with Excessive Size or Number).

Business impact

Exploitation of this vulnerability can disable network monitoring on affected Zeek sensors, creating blind spots in real-time threat detection and incident response capabilities. Organizations relying on Zeek for network visibility may lose the ability to observe lateral movement, data exfiltration, or other network-based attacks during an active security incident. The impact is availability-focused but operationally significant for security operations.

Affected systems

All Zeek installations running versions prior to 8.0.9 are affected. The vulnerability is triggered only when Zeek is actively monitoring FTP traffic and processes a maliciously crafted FTP session, so exposure depends on the presence of FTP activity in monitored networks and the default enabled state of the FTP analyzer.

Exploitability

This vulnerability is readily exploitable by any unauthenticated attacker with network access to a monitored path (can send packets through or to the monitored network). No authentication, credentials, or user interaction is required. The attack complexity is low—an attacker need only craft a specific FTP control sequence and transmit it. The barrier to exploitation is low, and tooling to generate the malicious payload is straightforward.

Remediation

Upgrade Zeek to version 8.0.9 or later. Organizations unable to patch immediately should consider temporarily disabling the FTP analyzer if FTP traffic monitoring is not operationally critical, or implement network-level filtering to restrict FTP traffic to trusted sources only. Verify the patch version against the official Zeek release notes.

Patch guidance

Apply the Zeek 8.0.9 or later update as soon as feasible given your change management process. The fix addresses the uncontrolled buffer expansion by implementing proper bounds checking on the NVT_Analyzer's line length handling. Review your Zeek deployment architecture to ensure updates can be rolled out with minimal monitoring downtime, and validate that patched sensors resume normal operation before decommissioning unpatched instances.

Detection guidance

Monitor Zeek process memory consumption and CPU usage for anomalous spikes correlated with FTP traffic patterns. Review Zeek logs and sensor health metrics for unexpected process restarts or out-of-memory errors. Network-side detection is difficult without packet inspection; however, observing repeated AUTH GSSAPI followed by unusually large ADAT lines from a single source may indicate exploitation attempts. Consider alerting on Zeek process crashes or restarts that correlate with inbound FTP sessions.

Why prioritize this

Although not yet listed in the CISA KEV catalog, this vulnerability merits prompt attention because it directly threatens the availability of a critical security tool. A successful attack disables network monitoring precisely when threat detection is most needed. The low barrier to exploitation, combined with the operational criticality of Zeek in many security stacks, makes this a near-term risk despite the lack of known active exploitation in the wild.

Risk score, explained

The CVSS 3.1 score of 7.5 (HIGH) reflects a network-exploitable vulnerability with no authentication required and a direct impact on availability. The attack vector is network-based, attack complexity is low, privileges and user interaction are not required, and the impact is limited to availability (no confidentiality or integrity breach). The score appropriately captures the operational risk of sensor denial of service without overstating the severity, since data confidentiality and integrity are not compromised.

Frequently asked questions