Vulnerability · Published Apr 17, 2026 · Assigned by GitHub_M

CVE-2026-40303zrok allows unauthenticated DoS via unbounded memory allocation in striped session cookie parsing

High 7.5

In plain English

A high-severity uncontrolled resource consumption in zrok from openziti. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 39% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)0.5%top 60.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

zrok is software for sharing web services, files, and network resources. Prior to version 2.0.1, endpoints.GetSessionCookie parses an attacker-supplied cookie chunk count and calls make([]string, count) with no upper bound before any token validation occurs. The function is reached on every request to an OAuth-protected proxy share, allowing an unauthenticated remote attacker to trigger gigabyte-scale heap allocations per request, leading to process-level OOM termination or repeated goroutine panics. Both publicProxy and dynamicProxy are affected. Version 2.0.1 patches the issue.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Go	github.com/openziti/zrok	no fix listed	GHSA-cpf9-ph2j-ccr9
Go	github.com/openziti/zrok	no fix listed	GO-2026-5329
Go	github.com/openziti/zrok/v2	2.0.1	GHSA-cpf9-ph2j-ccr9
Go	github.com/openziti/zrok/v2	2.0.1	GO-2026-5329

Affected products (as reported)

Vendor	Product	Versions
openziti	zrok	< 2.0.1

Weakness: CWE-400, CWE-789 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

https://github.com/openziti/zrok/security/advisories/GHSA-cpf9-ph2j-ccr9 x_refsource_CONFIRM
https://github.com/openziti/zrok/releases/tag/v2.0.1 x_refsource_MISC