CVE-2026-40303: zrok Denial of Service Vulnerability
HIGHCVE-2026-40303 is a HIGH (CVSS 7.5) denial of service vulnerability (CWE-789: Memory Allocation with Excessive Size Value) affecting zrok libraries in the Go ecosystem. The issue involves unauthenticated dos via unbounded memory allocation in striped session cookie parsing. Remediation is available by upgrading affected packages to version 2.0.1.
CVE-2026-40303 at a Glance
Security Impact
CVSS: 7.5
The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
How to Fix CVE-2026-40303
To remediate this vulnerability, upgrade all affected zrok dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.
Upgrade github.com/openziti/zrok to Latest secure releaseUpgrade github.com/openziti/zrok/v2 to 2.0.1Run the following command in your project directory to verify that all resolved dependencies use the patched release:
inspect dependencies for github.com/openziti/zrokHow to Check if You Are Affected
To determine whether your application is affected by CVE-2026-40303, inspect your project dependencies for zrok:
inspect dependencies for github.com/openziti/zrokAnalyze the terminal output to locate any version of zrok in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 2.0.1), your application is affected.
Note: Verify declared build manifests and deployed runtime container environments.
Technical Details
Vulnerability Mechanism & Technical Analysis
This vulnerability is classified under CWE-789: Memory Allocation with Excessive Size Value, where the product allocates memory based on an untrusted, large size value, but it does not ensure that the size is within expected limits, allowing arbitrary amounts of memory to be allocated. In zrok, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.
Source Advisory Statement
CVE-2026-40303 Affected zrok Versions
2 component(s)| Product / Package | Ecosystem | Affected Versions | Fixed Version |
|---|---|---|---|
|
github.com/openziti/zrok
|
Go |
≤ 1.1.11
|
|
|
github.com/openziti/zrok/v2
|
Go |
< 2.0.1
|
2.0.1
|
References
Frequently Asked Questions
What is CVE-2026-40303?
Which zrok versions are affected?
What version fixes CVE-2026-40303?
Is github.com/openziti/zrok affected?
Is github.com/openziti/zrok/v2 affected?
What is the CVSS score of CVE-2026-40303?
What CWE is associated with CVE-2026-40303?
How can I check Go dependencies for CVE-2026-40303?
Machine-readable OSV JSON
OSV v1.5 Schema
{
"schema_version" : "1.4.0",
"id" : "GHSA-cpf9-ph2j-ccr9",
"modified" : "2026-04-24T20:48:49Z",
"published" : "2026-04-16T21:09:08Z",
"aliases" : [ "CVE-2026-40303" ],
"summary" : "zrok: Unauthenticated DoS via unbounded memory allocation in striped session cookie parsing",
"details" : "**Summary**\nendpoints.GetSessionCookie parses an attacker-supplied cookie chunk count and calls make([]string, count) with no upper bound before any token validation occurs. The function is reached on every request to an OAuth-protected proxy share, allowing an unauthenticated remote attacker to trigger gigabyte-scale heap allocations per request, leading to process-level OOM termination or repeated goroutine panics. Both publicProxy and dynamicProxy are affected.\n\n- Attack Vector: Network — exploitable via a single HTTP request with a crafted Cookie header.\n- Attack Complexity: Low — no preconditions or chaining required; the attacker only needs to know the cookie name (publicly derivable from any OAuth redirect).\n- Privileges Required: None — reached before JWT validation or any authentication check.\n- User Interaction: None.\n- Scope: Unchanged — impact is confined to the affected proxy process.\n- Confidentiality Impact: None.\n- Integrity Impact: None.\n\nAvailability Impact: High — sustained or concurrent requests cause OOM process termination, taking down the proxy for all users of all shares it serves.\n\n**Affected Components**\n- endpoints/oauthCookies.go — GetSessionCookie (line 81)\n- endpoints/publicProxy/authOAuth.go — handleOAuth (line 50) — call site, pre-auth\n- endpoints/dynamicProxy/cookies.go — getSessionCookie (line 29) — call site",
"severity" : [ {
"type" : "CVSS_V3",
"score" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
} ],
"affected" : [ {
"package" : {
"ecosystem" : "Go",
"name" : "github.com/openziti/zrok"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "0"
}, {
"last_affected" : "1.1.11"
} ]
} ]
}, {
"package" : {
"ecosystem" : "Go",
"name" : "github.com/openziti/zrok/v2"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "0"
}, {
"fixed" : "2.0.1"
} ]
} ]
} ],
"references" : [ {
"type" : "WEB",
"url" : "https://github.com/openziti/zrok/security/advisories/GHSA-cpf9-ph2j-ccr9"
}, {
"type" : "ADVISORY",
"url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-40303"
}, {
"type" : "PACKAGE",
"url" : "https://github.com/openziti/zrok"
}, {
"type" : "WEB",
"url" : "https://github.com/openziti/zrok/releases/tag/v2.0.1"
} ],
"database_specific" : {
"cwe_ids" : [ "CWE-400", "CWE-789" ],
"severity" : "HIGH",
"github_reviewed" : true,
"github_reviewed_at" : "2026-04-16T21:09:08Z",
"nvd_published_at" : "2026-04-17T21:16:35Z"
}
}