Zeek versions prior to 8.0.9 contain an uncontrolled memory consumption flaw in their FTP analyzer. By establishing an unauthenticated FTP session that negotiates Auth GSSAPI and then sending a very large ADAT command, an attacker can force the NVT_Analyzer component to repeatedly double its internal buffer during base64 decoding of the ADAT token without enforcing a maximum line length. The buffer can grow without bounds, eventually exhausting system memory and terminating the Zeek sensor, which results in a denial of service to anyone relying on that sensor for network inspection.

All Zeek deployments using any releases earlier than 8.0.9 and that have the FTP analyzer enabled are affected. The flaw is present in the standard Zeek distribution distributed by the zeek:zeek vendor, so any installation that processes FTP control traffic is potentially vulnerable.

The CVSS score of 8.7 indicates a high severity denial‑of‑service risk. The EPSS score of less than 1% is low but non‑zero, meaning exploitation is unlikely but possible. The vulnerability is not listed in CISA’s KEV catalog, suggesting no widely known exploits yet exist. The attack vector is inferred to be an unauthenticated remote FTP session, with an attacker only needing to reach the Zeek sensor over the network to trigger the flaw. Environments exposing the Zeek sensor to untrusted networks face a significant risk of disruption if the flaw is not mitigated.