CVE-2026-60109 Zeek < 8.0.9 Null Pointer Dereference DoS via Kerberos KRB_ERROR Parsing

Q: What is CVE-2026-60109?

CVE-2026-60109 is a high-severity vulnerability in zeek, published on 9 Jul 2026.

Q: Is CVE-2026-60109 being exploited?

There is no known exploitation of CVE-2026-60109 in the wild and no public exploit code.

Q: How do I fix CVE-2026-60109?

No fix has been published for CVE-2026-60109 yet. Limit exposure of the affected software until one is available.

High 8.7 Published 9 Jul 2026 Updated 14 Jul 2026

Exploited in the wild: Not known
Fix: None listed

What is CVE-2026-60109?

CVE-2026-60109 is a high-severity vulnerability in zeek, published on 9 Jul 2026.

Official description

Zeek before 8.0.9 contains a null pointer dereference vulnerability in its Kerberos protocol analyzer that allows unauthenticated remote attackers to crash the sensor by sending a crafted KRB_ERROR message with error-code 25 (KDC_ERR_PREAUTH_REQUIRED) containing a PA-DATA element with padata-type 2, 3, 11, or 19. Attackers can exploit a parser and analyzer state mismatch where proc_padata() dereferences an uninitialized pa_data_element field selected by the wrong parsing arm, triggering a crash via a single UDP or TCP packet to port 88 without any credentials or prior authentication.

Weakness: CWE-476

Which versions are affected by CVE-2026-60109?

It affects 1 product.

Products include Zeek Zeek.

How do I fix CVE-2026-60109?

No fix has been published for CVE-2026-60109 yet. Limit exposure of the affected software until one is available.

Is CVE-2026-60109 being exploited?

There is no known exploitation of CVE-2026-60109 in the wild and no public exploit code.

Sources

Also known as GHSA-76hq-67jv-x5j7.