Zed Attack Proxy 2.17.0

The worlds most frequently used web app scanner. Free and Open Source.

  • By ZAP
  • Open Source
  • Updated Dec 15, 2025
Download for Windows

About Zed Attack Proxy

The worlds most frequently used web app scanner. Free and Open Source.

What's new in 2.17.0

This is a bug fix and enhancement release.
Alert De-duplication
Changes have been made in order to reduce the number of alerts which ZAP may raise that are duplicates or highly similar, more closely being aligned with the Sites Tree representation. See the Alert De-duplication blog for further details.
Systemic Alerts
Alerts that are typically site-wide will now be flagged as being “Systemic” in both the ZAP Desktop UI and in reports.
This can also significantly reduce the number of “duplicate” alerts reported.
Insights
A new “Insights” tab shows key information which is not related to vulnerabilities, or potentially even related to the application in question.
Insights tell you more about your applications, about the effectiveness of a scan, and can even stop a scan early if significant problems are identified.
Insights are also available in all of the official ZAP reports.
Improved Disk and Memory Space Error Handling
ZAP will now detect disk and memory space issues and attempt to handle them more gracefully.
Any problems encountered will be reported via the Insights.
Automation Disk Space Reduction
Active Scan Temporary HTTP Messages are no longer persisted by default when ZAP is run headless. This can significantly reduce the amount of disk space needed.
The option is also available in the Desktop but is turned off be default, so that the user can inspect them.
Structured Reports ISO 8601 Standard Date
The structured reports (JSON and XML) now have an ISO 8601 standard date field/attribute (“created”); the existing “generatedString” field will be removed in the future.
Dependency Updates
As usual the release includes dependency updates.
The following libraries were updated:
- Commons Beanutils, 1.10.1 → 1.11.0
- Commons Codec, 1.18.0 → 1.20.0
- Commons CSV, 1.12.0 → 1.14.1
- Commons IO, 2.18.0 → 2.21.0
- Commons Lang3, 2.17.0 → 3.19.0
- Commons Text, 1.13.0 → 1.14.0
- Flatlaf, 3.5.4 → 3.7
- Flatlaf Swingx, 3.5.4 → 3.6.2
- Jfreechart, 1.5.5 → 1.5.6
- Jgrapht Core, 0.9.0 → 0.9.2
- Log4j 1.2 API, 2.24.3 → 2.25.2
- Log4j API, 2.24.3 → 2.25.2
- Log4j Core, 2.24.3 → 2.25.2
- Log4j Jul, 2.24.3 → 2.25.2
Add-Ons
Updated Add-Ons
All of the add-ons included by default have been updated since the last full release.
New Add-Ons
- Insights - as detailed above
Enhancements
- Issue 434 : ZAP should exit when running out of memory
- Issue 2382 : IOException - data file enlarge failed
- Issue 3486 : Enhancement: ZAP GUI Warn User When its out of Memory …

Full release notes »

Technical details

PublisherZAP
Version2.17.0
Release date2025-12-15
LicenseApache-2.0
Installer typeexe
Architecturex64
Package IDZAP.ZAP
Admin rightsRequired
DependenciesEclipseAdoptium.Temurin.17.JRE

Install Zed Attack Proxy from the command line

Install with Windows Package Manager
winget install --id=ZAP.ZAP -e
Update to the latest version
winget upgrade --id=ZAP.ZAP -e
Uninstall
winget uninstall --id=ZAP.ZAP -e
Silent install with the offline installer
"ZAP_2_17_0_windows.exe" -q

dastscannersecurityzaproxy

Zed Attack Proxy version history

2.16.1 Mar 25, 2025

Release notes: https://www.zaproxy.org/docs/desktop/releases/2.16.1/
─────────────────────────────────┬────────────────────────────────────────────────────────────────
File │Checksum (SHA-256)
─────────────────────────────────┼────────────────────────────────────────────────────────────────
ZAP_2.16.1.dmg │79d7bc6db7e9583d3d90549791843998f0cf170ed975cfa01fac657f2e0d9120
─────────────────────────────────┼────────────────────────────────────────────────────────────────
ZAP_2.16.1_aarch64.dmg │aa3d1293856fdc380039a866b1e71c5ea24e6f6e3d0119607e365346b07d94d2
─────────────────────────────────┼────────────────────────────────────────────────────────────────
ZAP_2.16.1_Core.zip │e757f26d972847e6a1a89ed95a1f03ac310922ff7e8a7843ae164fcaa5d5ae06
─────────────────────────────────┼────────────────────────────────────────────────────────────────
ZAP_2.16.1_Crossplatform.zip │e90ca63b2fb213f2d5a53036a48d90a4c5c38b8a5c51768e75598a578c071415
─────────────────────────────────┼────────────────────────────────────────────────────────────────
ZAP_2.16.1_Linux.tar.gz │5b2eb8319b085121a6e8ad50d69d67dbef8c867166f71a937bfc888d247a2ac1
─────────────────────────────────┼────────────────────────────────────────────────────────────────
ZAP_2_16_1_unix.sh │8ebccf4b936858efbb0619a59210395b20fd8b312b93f3311fc2b745201ca26a …

2.16.0 Jan 10, 2025

This is a bug fix release, along with some minor enhancements.
This release was made possible thanks to Checkmarx who employ 3 of the Core Team to work on ZAP.
These release notes do not include all of the changes included in add-ons updated since 2.16.0.
The enhancements include:
Use Main Output Tab for Scripts
The Script Console no longer includes its own “Script Output” panel. Instead it uses the main Output tab.
Support Sub-tabs in Output Tab
The Output tab now supports sub-tabs. The Script Console add-on will add one tab for each script that generates any output, making it much easier to see where output messages come from.
API Support for Plugable Authentication and Session Management
The API now supports plugable Authentication and Session Management methods, which means you can configure modern options like Browser Based Authentication.
Authentication Enhancements
Many enhancements have been made to ensure ZAP handles authentication more easily and effectively, including support for TOTP.
Windows Native Decorations Support
ZAP now supports Native Decorations on Windows systems, providing a more unified and visually pleasing experience.
AJAX Spider URL Count
The AJAX Spider no longer counts URLs that are out of scope. This may affect any tests you have in place.
Dependency Updates
As usual the release includes dependency updates.
The following libraries were updated:
- Commons Beanutils, 1.9.4 → 1.10.1
- Commons Codec, 1.17.1 → 1.18.0
- Commons Logging, 1.3.4 → 1.3.5 …

Frequently asked questions

Is Zed Attack Proxy free?

Yes. Zed Attack Proxy is free and open-source software released under the Apache-2.0 license.

What is the latest version of Zed Attack Proxy?

The latest version is 2.17.0, released on Dec 15, 2025.

Is it safe to download Zed Attack Proxy?

The download button links to the official installer published on github.com, the same file Windows Package Manager installs. You can verify the downloaded file by comparing its SHA-256 checksum with ebdaf6f00ffd9c21891d29360196e13a14091f84dde2bfa1e0b61213a93bc5ca.

Which Windows versions does Zed Attack Proxy support?

Zed Attack Proxy runs on Windows and is available for 64-bit (x64) systems.

How do I install Zed Attack Proxy silently?

Run the offline installer with "ZAP_2_17_0_windows.exe" -q, or install it with Windows Package Manager: winget install --id=ZAP.ZAP -e --silent.

How do I uninstall Zed Attack Proxy?

Open Settings › Apps › Installed apps, find Zed Attack Proxy and select Uninstall. From the command line, run winget uninstall --id=ZAP.ZAP -e.

Related software