zrok, an open-source tool for sharing web services, contains a flaw that allows a remote attacker to trigger gigabyte‑scale heap allocations by sending a specially crafted cookie when accessing an OAuth‑protected proxy. The endpoint parses an attacker‑supplied cookie chunk count and creates a slice of that size before validating the token, exposing the process to uncontrolled memory usage. Failure to limit the allocation can cause the zrok process to be terminated by the operating system due to out‑of‑memory or repeatedly panic, resulting in a denial of service for all users sharing that endpoint.

The vulnerability affects the openziti:zrok service on all versions prior to 2.0.1, impacting both the publicProxy and dynamicProxy configurations. Version 2.0.1 and later contain the fix that limits the size of the cookie chunk count during parsing.

The CVSS score of 7.5 indicates a high severity, and the lack of an EPSS value means current exploitation propensity is unknown. The vulnerability is not listed in the CISA KEV catalog. Attackers only need to craft a request to an OAuth‑protected proxy; no authentication is required, so any external host can trigger the issue. Once activated, the memory exhaustion leads to service degradation or termination, which can be leveraged in targeted denial‑of‑service attacks.