CVE-2026-60109: zeek — Katalog CVE

csirt@kutim:~/threat-intel/cve/CVE-2026-60109

CVSS 7.5 · High EPSS 0,92%

Kerentanan NULL Pointer Dereference pada zeek. Skor CVSS 3.1 7.5 (High) menurut vulncheck.com.

Deskripsi (NVD)

Zeek before 8.0.9 contains a null pointer dereference vulnerability in its Kerberos protocol analyzer that allows unauthenticated remote attackers to crash the sensor by sending a crafted KRB_ERROR message with error-code 25 (KDC_ERR_PREAUTH_REQUIRED) containing a PA-DATA element with padata-type 2, 3, 11, or 19. Attackers can exploit a parser and analyzer state mismatch where proc_padata() dereferences an uninitialized pa_data_element field selected by the wrong parsing arm, triggering a crash via a single UDP or TCP packet to port 88 without any credentials or prior authentication.

Rincian

Terbit di NVD: 9 Juli 2026
Terakhir diubah: 14 Juli 2026
Status NVD: Analyzed
CVSS 3.1: 7.5 (High), sumber vulncheck.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-476: NULL Pointer Dereference
EPSS (30 hari): 0,92% peluang dieksploitasi; lebih tinggi dari 59,3% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
zeek	zeek	Semua versi sebelum 8.0.9

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://github.com/zeek/zeek/commit/c82e3c734893d932e94310aec0dbeb1ffcea169d patch
https://www.vulncheck.com/advisories/zeek-null-pointer-dereference-dos-via-kerberos-krb-error-parsing advisory pihak ketiga
https://github.com/zeek/zeek/releases/tag/v8.0.9 release notes

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:11 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.