Attributed metadata history
Up to 100 retained publisher events per page for b71b236a425f70594e7b43caa3505feddf8e3800cbecc4247a5d6740d2b2a830. Withdrawals and unavailable references remain attributed to their publishers.
intelligence_src_967fc5109ac4b9114d
observed · 2026-10-12 13:03:03 UTC
Thank you to Jan Grashöfer (@J-Gras), h4r4kIR1, Javid Khan (@dxbjavid), @jmestwa-coder, and @uwezkhan for their contributions to this release. This release fixes the following security issues: HIGH: The NVT, Rlogin, and RSH analyzers have received fixes to avoid unbounded state growth. Due to the fact that these packets can be received from remote hosts, these are considered DoS risks. The fixes include additional length-checking when processing packets, as well as a new set of weirds for when the standard Content-Line limits are exceeded. HIGH: A specially crafted WebSocket payload can cause the Spicy WebSocket analyzer to use excessive memory when processing close, ping, and pong frames. Due to the fact that these packets can be received from remote hosts, these are considered a DoS risk. The fix caps the size of those frames as per RFC 6455 (to 125 bytes) and adds a new weird for when that limit is exceeded. HIGH: A specially crafted series of Finger packets can cause the Spicy Finger analyzer to use excessive amounts of memory and potentially crash Zeek. Due to the fact that these packets can be received from remote hosts, this is considered a DoS risk. The fix includes
Fingerprint: 42d1174a6f5e6404b15b1208ccb1c4c8ad426e3d2d862a1c11f540ef0d1aebae
intelligence_src_967fc5109ac4b9114d
observed · 2026-10-12 13:03:03 UTC
available
Fingerprint: aad7192696c6b2cb08b8513f6429b7db52d95a93de11b872e872a4ec57aa6f95