Denial Of Service (DoS)

github.com/openziti/zrok is vulnerable to Denial Of Service DoS. The vulnerability is due to improper validation of an attacker-supplied cookie chunk count in the endpoints.GetSessionCookie function, which performs unbounded memory allocations before token validation, allowing an unauthenticated...

CVE-2026-40303: Uncontrolled Resource Consumption

zrok is software for sharing web services, files, and network resources. Prior to version 2.0.1, endpoints.GetSessionCookie parses an attacker-supplied cookie chunk count and calls makestring, count with no upper bound before any token validation occurs. The function is reached on every request t...