Junglewise Threat Intelligence

CVE-2026-60109: Zeek null pointer dereference in Kerberos protocol analyzer

CVE-2026-60109 · Severity: high · CVSS 7.5 · Published 2026-07-09

Executive brief

Zeek, a widely used network security monitoring platform, is vulnerable to a flaw that allows remote attackers to crash the system. By sending a single specially crafted network packet, an attacker can disable the monitoring sensor, leading to a loss of visibility into network traffic and potential security blind spots. This attack requires no user interaction or login credentials to execute.

Technical details

A null pointer dereference exists in the Zeek Kerberos protocol analyzer due to a state mismatch between the parser and the analyzer. Specifically, the 'proc_padata()' function dereferences an uninitialized 'pa_data_element' field when processing a KRB_ERROR message (error-code 25, KDC_ERR_PREAUTH_REQUIRED) containing specific PA-DATA types (2, 3, 11, or 19). An unauthenticated remote attacker can trigger this crash by sending a single crafted UDP or TCP packet to port 88. This vulnerability results in a Denial of Service (DoS) of the Zeek sensor. The issue is resolved in Zeek version 8.0.9.

Affected products

  • Zeek Zeek < 8.0.9

Timeline

  • 2026-07-06: patched: Zeek version 8.0.9 released
  • 2026-07-09: disclosed: CVE-2026-60109 published

References

Related threats