NULL byte input vulnerability in Zabbix Server/Proxy leveraging MySQL/MariaDB
CVE-2026-59783

2.3LOW

Key Information:

Vendor

Zabbix

Status
Zabbix
Vendor
CVE Published:
5 October 2026

What is CVE-2026-59783?

The Zabbix Server/Proxy is susceptible to a vulnerability where the introduction of certain NULL byte inputs into binary items can result in the crashing of the service. This issue is particularly problematic for organizations utilizing MySQL or MariaDB as their database backend, as it can lead to disruptions in availability, impacting continuous monitoring capabilities.

Affected Version(s)

Zabbix 7.0.0 <= 7.0.28

Zabbix 7.4.0 <= 7.4.12

References

https://support.zabbix.com/browse/ZBX-28194

CVSS V4

Score:
2.3
Severity:
LOW
Confidentiality:
None
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Zabbix wants to thank ylwango613 for submitting this report on the HackerOne bug bounty platform.
.