{"id":"GHSA-cpf9-ph2j-ccr9","summary":"zrok: Unauthenticated DoS via unbounded memory allocation in striped session cookie parsing","details":"**Summary**\nendpoints.GetSessionCookie parses an attacker-supplied cookie chunk count and calls make([]string, count) with no upper bound before any token validation occurs. The function is reached on every request to an OAuth-protected proxy share, allowing an unauthenticated remote attacker to trigger gigabyte-scale heap allocations per request, leading to process-level OOM termination or repeated goroutine panics. Both publicProxy and dynamicProxy are affected.\n\n- Attack Vector: Network — exploitable via a single HTTP request with a crafted Cookie header.\n- Attack Complexity: Low — no preconditions or chaining required; the attacker only needs to know the cookie name (publicly derivable from any OAuth redirect).\n- Privileges Required: None — reached before JWT validation or any authentication check.\n- User Interaction: None.\n- Scope: Unchanged — impact is confined to the affected proxy process.\n- Confidentiality Impact: None.\n- Integrity Impact: None.\n\nAvailability Impact: High — sustained or concurrent requests cause OOM process termination, taking down the proxy for all users of all shares it serves.\n\n**Affected Components**\n- endpoints/oauthCookies.go — GetSessionCookie (line 81)\n- endpoints/publicProxy/authOAuth.go — handleOAuth (line 50) — call site, pre-auth\n- endpoints/dynamicProxy/cookies.go — getSessionCookie (line 29) — call site","aliases":["CVE-2026-40303","GO-2026-5329"],"modified":"2026-06-25T19:56:15.928294968Z","published":"2026-04-16T21:09:08Z","database_specific":{"cwe_ids":["CWE-400","CWE-789"],"severity":"HIGH","github_reviewed":true,"github_reviewed_at":"2026-04-16T21:09:08Z","nvd_published_at":"2026-04-17T21:16:35Z"},"references":[{"type":"WEB","url":"https://github.com/openziti/zrok/security/advisories/GHSA-cpf9-ph2j-ccr9"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-40303"},{"type":"PACKAGE","url":"https://github.com/openziti/zrok"},{"type":"WEB","url":"https://github.com/openziti/zrok/releases/tag/v2.0.1"}],"affected":[{"package":{"name":"github.com/openziti/zrok","ecosystem":"Go","purl":"pkg:golang/github.com/openziti/zrok"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"last_affected":"1.1.11"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-cpf9-ph2j-ccr9/GHSA-cpf9-ph2j-ccr9.json"}},{"package":{"name":"github.com/openziti/zrok/v2","ecosystem":"Go","purl":"pkg:golang/github.com/openziti/zrok/v2"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.0.1"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-cpf9-ph2j-ccr9/GHSA-cpf9-ph2j-ccr9.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}]}