Attributed metadata history
Up to 100 retained publisher events per page for 9275cc36873f15693db0559615408eccbb63382e1961e47ca45300aa7e75b9ce. Withdrawals and unavailable references remain attributed to their publishers.
intelligence_src_967fc5109ac4b9114d
observed · 2026-10-12 13:03:03 UTC
Thank you to Jan Grashöfer (@J-Gras), h4r4kIR1, Javid Khan (@dxbjavid), @jmestwa-coder, and @uwezkhan for their contributions to this release. This release fixes the following security issues: HIGH: The NVT, Rlogin, and RSH analyzers have received fixes to avoid unbounded state growth. Due to the fact that these packets can be received from remote hosts, these are considered DoS risks. The fixes include additional length-checking when processing packets, as well as a new set of weirds for when the standard Content-Line limits are exceeded. HIGH: A specially crafted WebSocket payload can cause the Spicy WebSocket analyzer to use excessive memory when processing close, ping, and pong frames. Due to the fact that these packets can be received from remote hosts, these are considered a DoS risk. The fix caps the size of those frames as per RFC 6455 (to 125 bytes) and adds a new weird for when that limit is exceeded. HIGH: A specially crafted series of Finger packets can cause the Spicy Finger analyzer to use excessive amounts of memory and potentially crash Zeek. Due to the fact that these packets can be received from remote hosts, this is considered a DoS risk. The fix includes
Fingerprint: 0defcdb4bffc3f49a8b8f81580469e0142ccd2cfad87bcd14a4ea21b15124524
intelligence_src_967fc5109ac4b9114d
observed · 2026-10-12 13:03:03 UTC
available
Fingerprint: aad7192696c6b2cb08b8513f6429b7db52d95a93de11b872e872a4ec57aa6f95