Uncontrolled Memory Consumption in Zeek FTP Analyzer

CVE-2026-60108

What is CVE-2026-60108?

An uncontrolled memory consumption vulnerability exists in the FTP analyzer of Zeek versions before 8.0.9. This flaw allows unauthenticated remote attackers to exploit the system by sending a specially crafted FTP control session that negotiates AUTH GSSAPI, followed by a large ADAT control line. The absence of a maximum line length check in the NVT_Analyzer component allows for an unbounded increase in the internal buffer during the base64 decoding of the malicious ADAT token. This exploitation leads to denial of service, potentially terminating the Zeek sensor's processes.

References