Zabbix Server/Proxy Server DoS via JavaScript preprocessing (CVE-2026-23938)

Vulnerability Summary Vulnerability Name: Server DoS via JavaScript preprocessing or script items (CVE-2026-23938) Vulnerability Type: Denial of Service (DoS) Priority: Minor CVSS Score: 2.1 (Low) CVSS Vector: CVSS:3.4/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/NI:N/SC:N Affected Components Affected Components: Server, Proxy Known Attack Vectors: The attacker requires access to a regular (non-superuser) administrator account. Affected and Fixed Versions: - Affected: 6.0.8 - 6.0.49 - Fixed: 6.0.47 - Affected: 7.0.0 - 7.0.26 - Fixed: 7.0.27 - Affected: 7.4.0 - 7.4.10 - Fixed: 7.4.11 Remediation Mitigation: Update the affected components to their respective fixed versions. Known Issues: None Acknowledgments: Zabbix thanks mikx for submitting this report via the HackerOne bug bounty platform. Description Summary: Server Denial of Service (DoS) via JavaScript preprocessing or script items. Detailed Description: An authenticated administrator can cause a potential denial of service by creating specially crafted JavaScript preprocessing scripts or script items. Activity Created: 2 hours ago Updated: 2 hours ago Resolved: 2 hours ago Personnel Assigned To: Zabbix Support Reporter: Janis Nulle Votes: 0 Watchers: 0 Export Export Options: Available Additional Information Zabbix Version: 2.1 (Low) [Note: This appears to be a data mapping error in the source, likely intended to be the CVSS score or similar] Fixed Version: None Components: Proxy (P), Server (S) Tags: None Activity Log Comments: None Work Logs: None History: None Activity: None Code Block POC Code: None Summary This vulnerability is a server Denial of Service (DoS) caused by JavaScript preprocessing or script items, affecting multiple versions of Zabbix Server and Proxy. The remediation is to update to the specified fixed versions.

Goal Reached Thanks to every supporter — we hit 100%!

Zabbix Server/Proxy Server DoS via JavaScript preprocessing (CVE-2026-23938)