Threats affecting pkg:golang/github.com/openziti/zrok

zrok is software for sharing web services, files, and network resources. Prior to version 2.0.1, endpoints.GetSessionCookie parses an attacker-supplied cookie chunk count and calls make([]string, count) with no upper bound before any token validation occurs. The function is reached on every request to an OAuth-protected proxy share, allowing an unauthenticated remote attacker to trigger gigabyte-scale heap allocations per request, leading to process-level OOM termination or repeated goroutine panics. Both publicProxy and dynamicProxy are affected. Version 2.0.1 patches the issue.

CVE-2026-40302 is a cross-site scripting (XSS) vulnerability in openziti zrok versions prior to 2.0.1. The issue arises because the proxyUi template engine uses Go's text/template, which does not perform HTML escaping, instead of html/template. Specifically, the GitHub OAuth callback handlers embed the attacker-controlled refreshInterval query parameter directly into an error message that is rendered unescaped in HTML. This allows an attacker to craft a login URL that, after the victim completes the OAuth flow, causes arbitrary JavaScript execution in the OAuth server's origin. Version 2.0.1 addresses this vulnerability.