# Zeek IDS — CWE-407 Disclosure Brief
**2026-03-27 · Patch available — awaiting upstream merge**

## Finding

One O(n²) defect in Zeek's rule matching engine. `is_member_of()` in `RuleMatcher.cc` uses `std::ranges::find` on a `matched_rules` vector, called 6 times per packet per connection during rule evaluation. Measured at 239×. Patch ready for upstream review.

## The Defects

**zeek-0001 (PATCHED — HIGH):** `src/RuleMatcher.cc`

```cpp
// is_member_of() — called 6× per packet per connection:
bool is_member_of(const std::vector<Rule*>& rules, const Rule* rule) {
    return std::ranges::find(rules, rule) != rules.end();
    // O(R) scan per call — O(P×R×6) total
}
```

`std::ranges::find` O(R) scan on `matched_rules` vector, called 6× per packet per connection. For P packets, R rules, and C connections: **O(P × R × C × 6) total**. **Measured ratio: 239×.**

## Complexity Proof

For R=239 matched rules, 6 calls per packet:
- Per packet: O(6×R) = 1,434 comparisons
- Fixed: `unordered_set<intptr_t>` → O(6) per packet
- **239× measured ratio.**

## Impact

All Zeek IDS deployments. Zeek is the leading open-source network intrusion detection system used in enterprise security operations, academic research networks, and national cybersecurity infrastructure. Rule matching runs on every packet on every monitored connection. High-bandwidth monitoring points processing millions of packets per second with many active rules hit worst case. This is a security-critical path: degraded performance reduces threat detection coverage.

## The Fix

Replace `matched_rules` vector with `unordered_set<intptr_t>`:

```cpp
// Before
bool is_member_of(const std::vector<Rule*>& rules, const Rule* rule) {
    return std::ranges::find(rules, rule) != rules.end();  // O(R)
}

// After
// CWE-407 fix: unordered_set<intptr_t> for O(1) membership instead of O(R) scan.
bool is_member_of(const std::unordered_set<intptr_t>& rule_set, const Rule* rule) {
    return rule_set.count(reinterpret_cast<intptr_t>(rule)) > 0;  // O(1)
}
```

## Patch

`defects/zeek/patch/zeek-0001-rulematcher-hashset.patch`

## What We Ask

1. Confirm receipt and assign a GitHub Security Advisory or issue reference.
2. Validate the patch against your rule matching and packet processing test suite.
3. Assess CVE eligibility — 239× overhead in packet-per-second critical path of an IDS.
4. Coordinate a disclosure date — we are targeting 90 days from first contact.

Contact: see cover email. This brief is confidential until coordinated disclosure.
