{"id":"CVE-2026-40303","aliases":["GHSA-cpf9-ph2j-ccr9","GO-2026-5329"],"url":"https://o3.security/vulnerability/CVE-2026-40303","summary":"zrok allows unauthenticated DoS via unbounded memory allocation in striped session cookie parsing","details":"**Summary**\nendpoints.GetSessionCookie parses an attacker-supplied cookie chunk count and calls make([]string, count) with no upper bound before any token validation occurs. The function is reached on every request to an OAuth-protected proxy share, allowing an unauthenticated remote attacker to trigger gigabyte-scale heap allocations per request, leading to process-level OOM termination or repeated goroutine panics. Both publicProxy and dynamicProxy are affected.\n\n- Attack Vector: Network — exploitable via a single HTTP request with a crafted Cookie header.\n- Attack Complexity: Low — no preconditions or chaining required; the attacker only needs to know the cookie name (publicly derivable from any OAuth redirect).\n- Privileges Required: None — reached before JWT validation or any authentication check.\n- User Interaction: None.\n- Scope: Unchanged — impact is confined to the affected proxy process.\n- Confidentiality Impact: None.\n- Integrity Impact: None.\n\nAvailability Impact: High — sustained or concurrent requests cause OOM process termination, taking down the proxy for all users of all shares it serves.\n\n**Affected Components**\n- endpoints/oauthCookies.go — GetSessionCookie (line 81)\n- endpoints/publicProxy/authOAuth.go — handleOAuth (line 50) — call site, pre-auth\n- endpoints/dynamicProxy/cookies.go — getSessionCookie (line 29) — call site","published":"2026-04-17T21:01:51.899Z","modified":"2026-08-12T03:51:48.550460236Z","cvss":{"score":7.5,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},"epss":{"score":0.00453,"percentile":0.38497,"asOf":"2026-09-17"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Go","name":"github.com/openziti/zrok","fixedVersion":null},{"ecosystem":"Go","name":"github.com/openziti/zrok/v2","fixedVersion":"2.0.1"}],"fix":null,"references":[{"type":"WEB","url":"https://github.com/openziti/zrok/releases/tag/v2.0.1"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/40xxx/CVE-2026-40303.json"},{"type":"ADVISORY","url":"https://github.com/openziti/zrok/security/advisories/GHSA-cpf9-ph2j-ccr9"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-40303"},{"type":"PACKAGE","url":"https://github.com/openziti/zrok"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:48.550460236Z"}}