CVE-2026-40303: Netfoundry Zrok DOS Vulnerability

CVE-2026-40303 Overview

CVE-2026-40303 is a resource exhaustion vulnerability in zrok, software developed by NetFoundry for sharing web services, files, and network resources. The vulnerability exists in the endpoints.GetSessionCookie function, which parses an attacker-supplied cookie chunk count and calls make([]string, count) without any upper bound validation before token authentication occurs. This allows unauthenticated remote attackers to trigger massive heap allocations, leading to denial of service conditions.

Critical Impact

Unauthenticated remote attackers can trigger gigabyte-scale heap allocations per request, causing process-level OOM termination or repeated goroutine panics, effectively denying service to legitimate users of OAuth-protected proxy shares.

Affected Products

• Netfoundry zrok versions prior to 2.0.1
• zrok publicProxy component
• zrok dynamicProxy component

Discovery Timeline

• 2026-04-17 - CVE CVE-2026-40303 published to NVD
• 2026-04-23 - Last updated in NVD database

Technical Details for CVE-2026-40303

Vulnerability Analysis

This vulnerability is classified under CWE-400 (Uncontrolled Resource Consumption). The flaw resides in the session cookie handling logic of zrok's proxy functionality. When processing incoming requests to OAuth-protected proxy shares, the application parses a cookie value that specifies how many string chunks to allocate in memory. The critical issue is that this parsing and memory allocation occurs before any authentication or token validation takes place.

The attack surface is accessible via network without any authentication requirements or user interaction, making it trivially exploitable. An attacker can craft malicious requests specifying arbitrarily large chunk counts, forcing the application to allocate gigabytes of memory per request. This can rapidly exhaust available system memory, triggering either Out-of-Memory (OOM) killer termination of the process or causing repeated goroutine panics that destabilize the service.

Root Cause

The root cause is improper input validation in the endpoints.GetSessionCookie function. The function accepts an attacker-controlled integer value specifying the number of cookie chunks without implementing any upper bound validation. The absence of input sanitization before the make([]string, count) call allows unbounded memory allocation requests. This design flaw is compounded by the fact that the vulnerable code path is reached before any authentication checks, enabling unauthenticated exploitation.

Attack Vector

The attack is network-based and can be executed by any unauthenticated remote attacker who can reach an OAuth-protected proxy share. The attacker sends HTTP requests with specially crafted cookie values containing extremely large chunk count values. Each malicious request forces the zrok service to attempt allocating massive amounts of heap memory.

The vulnerability affects both the publicProxy and dynamicProxy components, meaning any zrok deployment utilizing OAuth-protected proxy shares is potentially vulnerable. The attack requires no special privileges, no user interaction, and can be automated to send many requests in rapid succession, quickly exhausting server resources.

Since no verified code examples are available, readers should consult the GitHub Security Advisory for detailed technical information about the vulnerability mechanism and exploitation vectors.

Detection Methods for CVE-2026-40303

Indicators of Compromise

• Unusual memory consumption spikes on servers running zrok proxy services
• Frequent OOM killer events or process terminations in system logs
• Repeated goroutine panic messages in zrok application logs
• High volume of requests to OAuth-protected proxy endpoints with abnormal cookie sizes

Detection Strategies

• Monitor system memory utilization and alert on rapid memory consumption increases
• Implement log analysis rules to detect OOM events and goroutine panic patterns
• Deploy network-level monitoring to identify suspicious request patterns targeting proxy endpoints
• Use application performance monitoring to track unusual resource allocation behavior in zrok services

Monitoring Recommendations

• Configure memory usage alerts with thresholds appropriate for your environment
• Enable detailed logging on zrok proxy components to capture request metadata
• Implement rate limiting on proxy endpoints as a detection and defense measure
• Review access logs for requests with abnormally large cookie header values

How to Mitigate CVE-2026-40303

Immediate Actions Required

• Upgrade zrok to version 2.0.1 or later immediately
• If immediate upgrade is not possible, consider temporarily disabling OAuth-protected proxy shares
• Implement network-level rate limiting to reduce the impact of exploitation attempts
• Monitor systems for signs of active exploitation while remediation is in progress

Patch Information

NetFoundry has addressed this vulnerability in zrok version 2.0.1. The patch implements proper upper bound validation on the cookie chunk count parameter before memory allocation occurs. Organizations should upgrade to this version or later to fully remediate the vulnerability.

For detailed patch information, see the GitHub Release v2.0.1 and the GitHub Security Advisory.

Workarounds

• Implement reverse proxy or WAF rules to limit maximum cookie header sizes
• Apply network-level rate limiting on endpoints serving OAuth-protected proxy shares
• Consider temporarily restricting access to affected proxy services to trusted IP ranges
• Deploy resource limits (cgroups, container memory limits) to prevent single-service OOM from affecting the entire system

# Example: Configure nginx rate limiting for zrok proxy endpoints
limit_req_zone $binary_remote_addr zone=zrok_limit:10m rate=10r/s;

location /proxy/ {
    limit_req zone=zrok_limit burst=20 nodelay;
    # Additional proxy configuration
}