Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
zrok is software for sharing web services, files, and network resources. Prior to version 2.0.1, endpoints.GetSessionCookie parses an attacker-supplied cookie chunk count and calls make([]string, count) with no upper bound before any token validation occurs. The function is reached on every request to an OAuth-protected proxy share, allowing an unauthenticated remote attacker to trigger gigabyte-scale heap allocations per request, leading to process-level OOM termination or repeated goroutine panics. Both publicProxy and dynamicProxy are affected. Version 2.0.1 patches the issue.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-04-17 | 2 | Disclosure2 |
| 2026-04-18 | 1 | General1 |
CVE-2026-40303 zrok is software for sharing web services, files, and network resources. Prior to version 2.0.1, endpoints.GetSessionCookie parses an attacker-supplied cookie chunk c… https://www.cve.org/CVERecord?id=CVE-2026-40303
Post summary
The post briefly describes a security flaw in zrok’s `GetSessionCookie` function but provides no PoC, exploit, patch, or evidence of active exploitation.
CVE-2026-40303 Unauthenticated Denial of Service via Unbounded Heap Allocation in zrok Before 2.0.1 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-40303
Post summary
The post releases a new CVE (CVE-2026-40303) describing an unauthenticated Denial of Service caused by an unbounded heap allocation in zrok versions prior to 2.0.1, but provides no additional details on patches, exploits, or active use.
🔴 Platform: Ziti Edge Router, Vulnerability Type: Unauthenticated Denial of Service, #CVE-2026-40303 (Critical) https://dailycve.com/platform-ziti-edge-router-vulnerability-type-unauthenticated-denial-of-service-cve-2026-40303-critical/
Post summary
An urgent unauthenticated denial‑of‑service vulnerability (CVE‑2026‑40303) affecting Ziti Edge Router has been disclosed, but no PoC, exploit code, active‑exploitation evidence, or patch information is provided.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | netfoundry | zrok | - | - | - |