HIGHVulnerability
Verified
Global

NVD HIGH: CVE-2026-60108 — Zeek before 8.0.9 contains an uncontrolled memory consumption vulnerability in t...

·Source: NIST NVD

Updated:

Executive Summary

Zeek before 8.0.9 contains an uncontrolled memory consumption vulnerability in the FTP analyzer that allows unauthenticated remote attackers to cause process termination by sending a crafted FTP control session negotiating AUTH GSSAPI followed by a large ADAT control line. Attackers can exploit the NVT_Analyzer component's lack of a maximum line length check, causing it to continuously double its

Analysis

Zeek before 8.0.9 contains an uncontrolled memory consumption vulnerability in the FTP analyzer that allows unauthenticated remote attackers to cause process termination by sending a crafted FTP control session negotiating AUTH GSSAPI followed by a large ADAT control line. Attackers can exploit the NVT_Analyzer component's lack of a maximum line length check, causing it to continuously double its internal buffer without bounds during base64 decoding of an attacker-controlled ADAT token, resulting in denial of service of the Zeek sensor. CVSS Score: 7.5. Published: 2026-07-09T15:16:41.627.

Indicators of Compromise (1)

CVE (1)
CVE-2026-60108
NVDMITRE CVE
Source Attribution

Originally published by NIST NVD on Jul 9, 2026. Verified by: NIST.

Related Threats

MEDIUMVulnerabilityNEW

Block reaches $45m Cash App fraud probe settlement with US states

Block has reached a $45 million settlement with 46 US states over allegations that the firm's Cash App peer-to-peer payments app failed to protect users from fraud.

Finextra
MEDIUMVulnerabilityNEW

Winning 54% of the time

With Wimbledon's help, Hazel argues against the popular myth that "Attackers only need to be right once, but defenders need to be right 100% of the time."

Cisco Talos
MEDIUMVulnerability

Interpol cybercrime crackdown nets 5,800 arrests across 97 countries

The anti-fraud crackdown, dubbed Operation First Light, identified more than 142,000 victims of various social-engineering scams. The post Interpol cybercrime crackdown nets 5,800 arrests across 97 countries appeared first on CyberScoop .

CyberScoop