Download Latest Version
v8.0.3 source code.tar.gz (36.1 MB)
Get an email when there's a new version of Zeek
| Name | Modified | Size | Downloads / Week |
|---|---|---|---|
| Parent folder | |||
| zeek-8.0.2.tar.gz | 2025-10-13 | 99.6 MB | |
| zeek-8.0.2.tar.gz.asc | 2025-10-13 | 833 Bytes | |
| README.md | 2025-10-13 | 1.0 kB | |
| v8.0.2 source code.tar.gz | 2025-10-13 | 32.5 MB | |
| v8.0.2 source code.zip | 2025-10-13 | 36.8 MB | |
| Totals: 5 Items | 168.9 MB | 5 | |
We would like to thank Jeff McJunkin (@jeffmcjunkin) and Peter Cullen (@pbcullen) for their contributions to this release.
This release fixes the following security issue:
- The KRB analyzer can leak information about hosts in analyzed traffic via external DNS
lookups. This only happens if the script-level variable
KRB::keytabis set to point at a valid Kerberos keytab file. We're opting to fix the analyzer so it can't happen at all. The fix is to use a different method from libkrb5 that reuses known host information from the packets instead of re-requesting the same information externally.
This release fixes the following bugs:
-
The
get_current_packet_header()BIF now populates the returned record also for fragmented IP datagrams. -
The
decompose_uri()script function now correctly handles URIs containing IPv6 addresses. -
The QUIC parser now discards packets with the fixed_bit field set to 0, rather than continuing to parse and potentially running into analyzer violations.