Zabbix Server and Proxy Denial-of-Service Vulnerability Due to Uncontrolled Resource Exhaustion

A denial-of-service vulnerability has been identified in Zabbix Server and Zabbix Proxy, versions 6.0.0 through 6.0.38, 7.0.0 through 7.0.9, and 7.2.0 through 7.2.3. This vulnerability allows an attacker to send specially crafted requests that cause the server to excessively allocate memory and engage in CPU-intensive decompression tasks, leading to a service crash.

Impact

Exploitation of this vulnerability causes the Zabbix server or proxy to crash, disrupting service.

Remediation

Users can upgrade to Zabbix versions 6.0.39rc1, 7.0.10rc1, or 7.2.4rc1 to address this vulnerability.