PT-2026-33379 · Zrok · Zrok

Published 2026-04-16 · Updated 2026-04-18 · CVE-2026-40303

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions zrok versions prior to 2.0.1

Description The GetSessionCookie() function in the endpoints module parses an attacker-supplied cookie chunk count and calls make([]string, count) without an upper bound before token validation. This occurs on every request to an OAuth-protected proxy share, specifically affecting publicProxy and dynamicProxy. An unauthenticated remote attacker can send a single HTTP request with a crafted Cookie header to trigger gigabyte-scale heap allocations, leading to process-level Out-of-Memory (OOM) termination or repeated goroutine panics, which results in a denial of service for all users of the shares served by the proxy.

Recommendations Update to version 2.0.1.

Fix

DoS

Resource Exhaustion

Weakness Enumeration

CWE-400

CWE-789

Related Identifiers

CVE-2026-40303

GHSA-CPF9-PH2J-CCR9

Affected Products

Zrok

References · 8

• https://github.com/openziti/zrok/security/advisories/GHSA-cpf9-ph2j-ccr9 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-cpf9-ph2j-ccr9 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-40303 · Security Note
• https://github.com/openziti/zrok · Note
• https://github.com/openziti/zrok/releases/tag/v2.0.1 · Note
• https://twitter.com/CVEnew/status/2045467390176108563 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2045268266189283787 · Twitter Post
• https://twitter.com/dailycve/status/2044932977440809085 · Twitter Post