# CVE-2026-40303

> Vulnerability · severity: **HIGH** (CVSS 7.5).

## Description

zrok is software for sharing web services, files, and network resources. Prior to version 2.0.1, endpoints.GetSessionCookie parses an attacker-supplied cookie chunk count and calls make([]string, count) with no upper bound before any token validation occurs. The function is reached on every request to an OAuth-protected proxy share, allowing an unauthenticated remote attacker to trigger gigabyte-scale heap allocations per request, leading to process-level OOM termination or repeated goroutine panics. Both publicProxy and dynamicProxy are affected. Version 2.0.1 patches the issue.

## Key facts

- **CVE ID:** CVE-2026-40303
- **Published:** 2026-04-17
- **CVSS severity:** HIGH
- **CVSS base score:** 7.5
- **CWE codes:** CWE-400, CWE-789

## Affected products

- `netfoundry:zrok`

## Primary sources

- NIST NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-40303

## Citation

> AI Analytics. CVE-2026-40303. Retrieved 2026-07-20 from https://api.ai-analytics.org/cve/CVE-2026-40303. Derived from NIST NVD. Licensed CC0.

---

*[Dataset catalog](https://api.ai-analytics.org/datasets/) · [AI Analytics](https://api.ai-analytics.org/) · CC0 1.0*