Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-60109— Zeek < 8.0.9 Null Pointer Dereference DoS via Kerberos KRB_ERROR Parsing

Quick assessment

Affected
zeek zeek
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Zeek是zeek团队开源的一个网络分析框架。 Zeek Network Monitoring Project Zeek Network Security Monitor 8.0.9之前版本存在异常处理不当漏洞，该漏洞源于Kerberos协议分析器中proc_padata()函数取消引用由错误解析分支选择的未初始化pa_data_element字段，导致解析器和分析器状态不匹配，可能允许未经身份验证的远程攻击者通过向端口88发送特制的KRB_ERROR消息，触发空指针取消引用，从而崩溃传感器。

CVSS 7.5 · High EPSS 0.92% · P60

Affected Version Matrix 1

VendorProduct Version RangeStatus
zeek zeek < 8.0.9 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-60109

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Zeek < 8.0.9 Null Pointer Dereference DoS via Kerberos KRB_ERROR Parsing
Source: CVE Program / CVE List V5
Vulnerability Description
Zeek before 8.0.9 contains a null pointer dereference vulnerability in its Kerberos protocol analyzer that allows unauthenticated remote attackers to crash the sensor by sending a crafted KRB_ERROR message with error-code 25 (KDC_ERR_PREAUTH_REQUIRED) containing a PA-DATA element with padata-type 2, 3, 11, or 19. Attackers can exploit a parser and analyzer state mismatch where proc_padata() dereferences an uninitialized pa_data_element field selected by the wrong parsing arm, triggering a crash via a single UDP or TCP packet to port 88 without any credentials or prior authentication.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
空指针解引用
Source: CVE Program / CVE List V5
Vulnerability Title
Zeek Network Monitoring Project Zeek Network Security Monitor 异常处理不当漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Zeek是zeek团队开源的一个网络分析框架。 Zeek Network Monitoring Project Zeek Network Security Monitor 8.0.9之前版本存在异常处理不当漏洞，该漏洞源于Kerberos协议分析器中proc_padata()函数取消引用由错误解析分支选择的未初始化pa_data_element字段，导致解析器和分析器状态不匹配，可能允许未经身份验证的远程攻击者通过向端口88发送特制的KRB_ERROR消息，触发空指针取消引用，从而崩溃传感器。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
zeek zeek 0 ~ 8.0.9 -

II. Public POCs for CVE-2026-60109

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-60109

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-60109 (1)

Vendor Advisories for CVE-2026-60109 (1)

Vendor Pages for CVE-2026-60109 (1)

IV. Related Vulnerabilities

Same product: zeek
Same vendor: zeek
Same weakness: CWE-476