CVE-2026-60109: Zeek Kerberos Analyzer Null Pointer Denial-of-Service

Technical summary

CVE-2026-60109 is a null pointer dereference (CWE-476) in Zeek's Kerberos protocol analyzer. The vulnerability stems from a state mismatch between the parser and analyzer: when processing a KRB_ERROR message with error-code 25 (KDC_ERR_PREAUTH_REQUIRED) containing a PA-DATA element with specific padata-type values (2, 3, 11, or 19), the proc_padata() function dereferences an uninitialized pa_data_element field. The attacker-controlled parsing path selects the wrong arm of a conditional parser, leaving the field uninitialized when the analyzer attempts to reference it. A single UDP or TCP packet to port 88 triggers the crash.

Business impact

Network visibility is fundamental to security operations. A Zeek sensor crash means loss of real-time traffic analysis, threat detection, and network forensics until the service is manually restarted. For organizations relying on Zeek for threat detection, incident response, or compliance monitoring, this vulnerability allows attackers to blind security teams by disrupting monitoring. In a multi-sensor architecture, targeted crashes can create gaps in coverage. The attack requires no authentication, making it trivially exploitable by any network-adjacent attacker.

Affected systems

Zeek versions before 8.0.9 are vulnerable. This applies to both standalone Zeek deployments and Zeek instances embedded in Corelight appliances or other commercial NSM platforms. The vulnerability affects any Zeek installation that monitors traffic on networks where an unauthenticated attacker can send packets to port 88 (typically Kerberos services).

Exploitability

Exploitability is high. The attack requires no authentication, no user interaction, and no complex setup—a single crafted UDP or TCP packet to port 88 triggers the crash. The attacker only needs network access to the Zeek sensor or a path to it. The attack is reliable (deterministic null pointer dereference) and can be scripted trivially. No KEV entry exists yet, but the straightforward nature of the exploit means public proof-of-concept code is likely imminent or already in use by security researchers.

Remediation

Upgrade Zeek to version 8.0.9 or later. Organizations should test the upgrade in a non-production environment first, then apply it promptly to all Zeek sensors. Until patching is complete, implement network controls: restrict access to port 88 on Zeek sensors to trusted networks, or use local firewall rules to block suspicious Kerberos traffic patterns if operationally feasible (risk: may impact legitimate Kerberos monitoring). These controls mitigate but do not eliminate the risk.

Patch guidance

Verify that Zeek 8.0.9 or later is deployed. Check the version via 'zeek --version' on each sensor. If using Corelight or another vendor's Zeek-based platform, consult the vendor advisory to confirm patched versions. Test patches in a lab environment with representative Kerberos traffic before rolling out to production to ensure no regression in monitoring or detection rules. Document the patch date and version across all sensors for compliance and incident response records.

Detection guidance

Monitor Zeek process restarts and crashes on sensors—frequent unexplained crashes may indicate exploitation attempts. Check Zeek logs for parser or analyzer errors related to Kerberos (error-code 25, PA-DATA processing). Network-level detection is difficult because the malicious packet is a valid (though crafted) Kerberos protocol message; however, correlation of crashes with spikes in KRB_ERROR messages to port 88 is a signal. Maintain baseline alerting on Zeek service availability. After patching, review logs to identify any crash events during the vulnerability window as indicators of prior exploitation.

Why prioritize this

This vulnerability scores HIGH (CVSS 7.5) due to high exploitability (network, no auth, low complexity), broad impact (denial of service to critical monitoring), and the strategic value of blinding security infrastructure. Although it does not result in data breach or code execution, availability of NSM infrastructure is business-critical. Prioritize patching of all Zeek sensors within 30 days; expedite if sensors are exposed to untrusted networks or are primary detection points.

Risk score, explained

CVSS 7.5 reflects a network-exploitable denial-of-service attack with no authentication requirement and direct impact on sensor availability (High availability impact). The attack vector is network-accessible, attack complexity is low, and no user interaction is needed. Confidentiality and integrity are not affected (the sensor crashes, but data is not leaked or modified). In the context of NSM, this HIGH severity rating is appropriate because loss of monitoring is a significant risk multiplier: while the sensor is down, active intrusions may go undetected.

Frequently asked questions