zrok Heap Overflow: Unauthenticated DoS Risk

The National Vulnerability Database (NVD) has detailed CVE-2026-40303, a critical vulnerability in zrok, a popular tool for sharing web services, files, and network resources. Prior to version 2.0.1, the endpoints.GetSessionCookie function within zrok improperly handles attacker-supplied cookie chunk counts. This flaw allows an unauthenticated remote attacker to trigger massive heap allocations, leading to gigabyte-scale memory consumption per request.

This memory exhaustion can result in process-level Out-of-Memory (OOM) termination or repeated goroutine panics. Both publicProxy and dynamicProxy functionalities are affected, making widespread exploitation feasible. The NVD assigns a CVSS score of 7.5 (HIGH), emphasizing the severe availability impact (A:H) with no required privileges (PR:N) or user interaction (UI:N).

Attackers can leverage this vulnerability to launch effective Denial-of-Service (DoS) attacks, crippling zrok instances. Organizations relying on zrok for critical sharing operations face significant operational disruption if not patched. The fix is available in zrok version 2.0.1, which addresses the unbounded allocation by properly validating the count parameter before memory allocation.