Uncontrolled Memory Consumption in Zeek FTP Analyzer

Executive Summary

CVE-2026-60108 is a vulnerability in Zeek versions before 8.0.9 that affects the FTP analyzer component. It allows unauthenticated remote attackers to cause the Zeek process to terminate by sending a specially crafted FTP control session. This session negotiates AUTH GSSAPI followed by a large ADAT control line.

The root cause is that the NVT_Analyzer component does not enforce a maximum line length during base64 decoding of the attacker-controlled ADAT token. This lack of limit causes the internal buffer to continuously double in size without bounds, leading to uncontrolled memory consumption.

As a result, the Zeek sensor crashes due to excessive memory use, causing a denial of service condition.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact you by causing a denial of service (DoS) on your Zeek network sensor. An attacker can remotely and without authentication crash the Zeek process by exploiting the uncontrolled memory consumption flaw.

The crash results from the sensor's internal buffer growing without limits when processing a maliciously crafted FTP control session, which can disrupt network monitoring and security analysis.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by monitoring FTP control sessions for unusual AUTH GSSAPI negotiations followed by abnormally large ADAT control lines, which are indicators of an attempted exploit.

Network administrators can use packet capture tools like tcpdump or Wireshark to filter and inspect FTP traffic for AUTH GSSAPI commands and large ADAT tokens.

• Use tcpdump to capture FTP control traffic: tcpdump -i <interface> 'tcp port 21'
• Filter captured traffic for AUTH GSSAPI commands and large ADAT lines using Wireshark display filters such as: ftp.request.command == "AUTH" and ftp.request.arg contains "GSSAPI"
• Analyze logs from Zeek sensors for unexpected process terminations or memory consumption spikes related to FTP analyzer activity.

Useful 0 Not Useful 0

Mitigation Strategies

The primary mitigation step is to upgrade Zeek to version 8.0.9 or later, where the vulnerability has been fixed by enforcing maximum line length checks to prevent uncontrolled memory consumption.

If upgrading immediately is not possible, consider temporarily disabling or restricting the FTP analyzer component to prevent processing of potentially malicious FTP AUTH GSSAPI sessions.

Monitor Zeek sensor resource usage closely and implement network-level controls to limit or block suspicious FTP traffic that attempts to negotiate AUTH GSSAPI with large ADAT tokens.

Useful 0 Not Useful 0