Zeek IDS — CWE-407 Disclosure Brief

2026-03-27 · Patch available — awaiting upstream merge

Finding

One O(n²) defect in Zeek's rule matching engine. is_member_of() in RuleMatcher.cc uses std::ranges::find on a matched_rules vector, called 6 times per packet per connection during rule evaluation. Measured at 239×. Patch ready for upstream review.

The Defects

zeek-0001 (PATCHED — HIGH): src/RuleMatcher.cc

// is_member_of() — called 6× per packet per connection:
bool is_member_of(const std::vector<Rule*>& rules, const Rule* rule) {
    return std::ranges::find(rules, rule) != rules.end();
    // O(R) scan per call — O(P×R×6) total
}

std::ranges::find O(R) scan on matched_rules vector, called 6× per packet per connection. For P packets, R rules, and C connections: O(P × R × C × 6) total. Measured ratio: 239×.

Complexity Proof

For R=239 matched rules, 6 calls per packet:

Per packet: O(6×R) = 1,434 comparisons
Fixed: unordered_set<intptr_t> → O(6) per packet
239× measured ratio.

Impact

All Zeek IDS deployments. Zeek is the leading open-source network intrusion detection system used in enterprise security operations, academic research networks, and national cybersecurity infrastructure. Rule matching runs on every packet on every monitored connection. High-bandwidth monitoring points processing millions of packets per second with many active rules hit worst case. This is a security-critical path: degraded performance reduces threat detection coverage.

The Fix

Replace matched_rules vector with unordered_set<intptr_t>:

// Before
bool is_member_of(const std::vector<Rule*>& rules, const Rule* rule) {
    return std::ranges::find(rules, rule) != rules.end();  // O(R)
}

// After
// CWE-407 fix: unordered_set<intptr_t> for O(1) membership instead of O(R) scan.
bool is_member_of(const std::unordered_set<intptr_t>& rule_set, const Rule* rule) {
    return rule_set.count(reinterpret_cast<intptr_t>(rule)) > 0;  // O(1)
}

Patch

defects/zeek/patch/zeek-0001-rulematcher-hashset.patch

What We Ask

Confirm receipt and assign a GitHub Security Advisory or issue reference.
Validate the patch against your rule matching and packet processing test suite.
Assess CVE eligibility — 239× overhead in packet-per-second critical path of an IDS.
Coordinate a disclosure date — we are targeting 90 days from first contact.

Contact: see cover email. This brief is confidential until coordinated disclosure.

2.5 KiB Raw Permalink Blame History Unescape Escape