CVE-2026-40303

Summary

zrok is software for sharing web services, files, and network resources. Prior to version 2.0.1, endpoints.GetSessionCookie parses an attacker-supplied cookie chunk count and calls make([]string, count) with no upper bound before any token validation occurs. The function is reached on every request to an OAuth-protected proxy share, allowing an unauthenticated remote attacker to trigger gigabyte-scale heap allocations per request, leading to process-level OOM termination or repeated goroutine panics. Both publicProxy and dynamicProxy are affected. Version 2.0.1 patches the issue.

Affected Software

Weaknesses

• CWE-400: CWE-400: Uncontrolled Resource Consumption
• CWE-789: CWE-789: Memory Allocation with Excessive Size Value

ADP Enrichment

CISA ADP Vulnrichment

• SSVC:
• Exploitation: none
  • Automatable: yes
  • Technical Impact: partial

References

• https://github.com/openziti/zrok/security/advisories/GHSA-cpf9-ph2j-ccr9
• https://github.com/openziti/zrok/releases/tag/v2.0.1

• ←Previous
• Next→