Threads

Running ZAP in daemon mode on an EC2 instance with -host the all-interfaces address and then pointing a browser at the instance's public IP and port makes ZAP unresponsive with ZAP Error [java.net.SocketTimeoutException]: Read timed out. The root cause the reporter found: ZAP listens on all interfaces, sees the incoming request to its own public IP as a request to proxy, forwards it to itself, and loops until it runs out of memory.

The immediate workaround that worked: put nginx in front of ZAP as a reverse proxy and access ZAP through it instead of hitting the daemon port directly. The diagnosis, requests to ZAP's own public address being proxied back into itself, is the thing to remember if you run ZAP bound to the all-interfaces address on a cloud VM.

Source: https://github.com/zaproxy/zaproxy/issues/2318