CVE-2026-59783: 
Zabbix Server vulnerability analysis and mitigation

CVE-2026-59783 is a Denial of Service vulnerability in Zabbix Server and Proxy where binary items can crash the service upon receiving certain NULL byte input. It exclusively affects deployments using MySQL/MariaDB as the Zabbix database backend. Affected versions are Zabbix 7.0.0 through 7.0.28 and 7.4.0 through 7.4.12. The vulnerability was disclosed on October 5, 2026, and carries a CVSS v4.0 base score of 2.3 (Low) (Zabbix Bug Tracker, GitHub Advisory).

The root cause is classified as CWE-787 (Out-of-bounds Write) and CWE-464 (Addition of Data Structure Sentinel), where the server/proxy fails to properly handle NULL bytes embedded in binary item data before writing to the MySQL/MariaDB backend, causing a crash (GitHub Advisory, Zabbix Bug Tracker). The attack vector is network-based and requires low privileges — specifically, an attacker with trapper access can send maliciously crafted binary item data containing NULL bytes to trigger the crash. Attack requirements include the presence of specific deployment conditions (MySQL/MariaDB backend), and no user interaction is needed. The vulnerability was reported by researcher ylwango613 via the HackerOne bug bounty platform (Zabbix Bug Tracker).

Successful exploitation results in a crash of the Zabbix Server or Proxy process, causing a loss of availability for the monitoring infrastructure. There is no impact on confidentiality or integrity — the vulnerability is limited to a denial of service condition. Deployments using PostgreSQL or other non-MySQL/MariaDB databases are not affected, limiting the scope to a subset of Zabbix installations (Zabbix Bug Tracker, GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (GitHub Advisory). The EPSS score is approximately 0.226%, placing it in the 12th percentile for exploitation likelihood within 30 days. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. NVD SSVC assessment classifies exploitation as "none" and the vulnerability as non-automatable (Feedly).

1. Reconnaissance: Identify Zabbix Server or Proxy instances running versions 7.0.0–7.0.28 or 7.4.0–7.4.12 with MySQL/MariaDB as the database backend, accessible via the Zabbix trapper port (default TCP 10051).
2. Obtain trapper access: Acquire low-privilege credentials or access to a monitored host that is permitted to submit trapper item data to the Zabbix Server/Proxy.
3. Craft malicious payload: Construct a binary item submission containing NULL byte(s) in the data field, targeting a configured binary item key on the server.
4. Send payload: Transmit the crafted trapper request to the Zabbix Server/Proxy trapper listener (TCP 10051), triggering the out-of-bounds write condition.
5. Achieve DoS: The server/proxy process crashes upon attempting to write the NULL-byte-containing data to the MySQL/MariaDB database, causing service unavailability (Zabbix Bug Tracker).

• Network: Unexpected or repeated connections to Zabbix trapper port (TCP 10051) from untrusted or external hosts; binary item submissions containing NULL bytes (\x00) in the data payload.
• Logs: Zabbix server/proxy crash logs or core dump files generated around the time of suspicious trapper connections; MySQL/MariaDB error logs showing abnormal query termination or data truncation errors related to binary fields.
• Process: Unexpected termination or restart of the zabbix_server or zabbix_proxy process; monitoring alerts for Zabbix service unavailability.

Zabbix has released fixed versions 7.0.29 and 7.4.13 to address this vulnerability; upgrading to these versions is the recommended remediation (Zabbix Bug Tracker). As a workaround, administrators should disable item data collection for any binary items that accept untrusted input. Additionally, restricting network access to the Zabbix Server/Proxy trapper port (TCP 10051) to only trusted monitoring agents reduces the attack surface. Deployments using PostgreSQL or other non-MySQL/MariaDB databases are not affected and require no action.