CVE-2026-60108

Name of the Vulnerable Software and Affected Versions Zeek versions prior to 8.0.9

Description The FTP analyzer contains an issue where unauthenticated remote attackers can cause process termination. By negotiating AUTH GSSAPI and sending a large ADAT control line, attackers can exploit the NVT Analyzer component. The component lacks a maximum line length check, which causes the internal buffer to double without bounds during the base64 decoding of an attacker-controlled ADAT token, leading to a denial of service of the Zeek sensor.

Recommendations Update to version 8.0.9 or later.