The vulnerability in openziti zrok (CVE-2026-40303) involves the GetSessionCookie function parsing an attacker-controlled cookie chunk count without an upper bound before validating tokens. This allows an unauthenticated remote attacker to cause excessive memory allocation by calling make([]string, count) with a large count value. The flaw is exploitable on every request to an OAuth-protected proxy share, impacting both publicProxy and dynamicProxy. The resulting uncontrolled resource consumption can cause the process to run out of memory or experience repeated goroutine panics, leading to denial of service. The issue is fixed in version 2.0.1.

An unauthenticated remote attacker can exploit this vulnerability to cause denial of service by triggering large heap allocations that exhaust system memory, resulting in process termination or instability. There is no impact on confidentiality or integrity as per the CVSS vector, but availability is severely affected.

Version 2.0.1 of openziti zrok patches this vulnerability. Users should upgrade to version 2.0.1 or later to remediate the issue. Since no official remediation level or patch link is provided beyond this version information, verify with the vendor's advisory for the latest updates. Until patched, consider restricting access to OAuth-protected proxy shares or implementing rate limiting to reduce exposure.