FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

zeek -- multiple vulnerabilities

Affected packages
zeek < 8.0.10

Details

VuXML ID e6a17802-cda9-4f53-8870-b629e4ac3d40
Discovery 2026-08-19
Entry 2026-08-19

Tim Wojtulewicz of Corelight reports:

HIGH: SMB: Chains of AndX messages can crash Zeek

HIGH: DNP3: Memory exhaustion via file control (g70v1) fields

HIGH: SIP: Memory exhaustion from long request/response paths

HIGH: DHCP: Memory exhaustion from retained options after analyzer violation

HIGH: SMTP: Memory exhaustion from large numbers of rcptto/to/cc/path entries

HIGH: SMB: DCE/RPC memory exhaustion from fragment state

HIGH: Analyzer manager: Equivalent scheduled analyzers could exhaust memory

HIGH: ZIP: Unbounded decompression

HIGH: Redis: Parsed Redis traffic memory exhaustion

HIGH: Invalid IPv6 fragments can lead to unbounded state growth

HIGH: SSH: Quadratic KEX algorithm CPU exhaustion

HIGH: NVT: Oversized line recovery writes before heap buffer

HIGH: DHCP: Unbounded state growth via join_data

HIGH: FTP: Unbounded state growth via ftp_data_expected

HIGH: OCSP: Empty byName responder ID crashes Zeek

HIGH: ARP: Tunneled ARP traffic crashes Zeek

HIGH: LDAP: Unbounded per-connection script state

HIGH: IRC DCC SEND has unbounded state growth

HIGH: tunnel_changed event limit bypass on direct/tunneled toggles

HIGH: Recursive stack exhaustion from deep packet analyzer chains

MEDIUM: Telnet: AUTH STATUS options before a NAME is received results in event argument mismatch

MEDIUM: UDP: udp_contents events could trigger out-of-bounds reads

MEDIUM: NetBIOS: Memory exhaustion from declared session lengths

MEDIUM: IRC: Single DCC Send packet can result in scripting error

MEDIUM: IRC: Invalid DCC Send host/port fields can lead to unexpected parsing results

References

URL https://github.com/zeek/zeek/releases/tag/v8.0.10