Zcashfoundation vulnerabilities

Products

• Zebra 49
• Zebra-consensus 3
• Zebra-state 3
• Zebra-chain 2
• Zebrad 2

Newest

• zcashfoundation zebra Zebra before 7.0.0 Sync Denial of Service via Forged Checkpoint Block Body CVE-2026-123560 8.7 HighNovember 8, 2026
• zcashfoundation zebra Zebra before 7.0.0 Denial of Service via Quadratic Sighash Computation CVE-2026-123559 8.7 HighNovember 8, 2026
• zcashfoundation zebra Zebra before 7.0.0 Checkpoint Sync Denial of Service via Cancelled Verifier Rewind CVE-2026-123558 8.7 HighNovember 8, 2026
• zcashfoundation zebra Zebra zebrad before 7.0.0 Reachable Assertion DoS via Peer Disconnection CVE-2026-123557 8.2 HighNovember 8, 2026
• zcashfoundation zebra Zebra 4.5.0 before 7.0.0 Honest Peer Ban via Mempool Lock-Time Scoring CVE-2026-123556 6.9 MediumNovember 8, 2026
• zcashfoundation zebra Zebra 2.3.0 before 7.0.0 Denial of Service via Unscored Script Verification Failures CVE-2026-123555 8.7 HighNovember 8, 2026
• zcashfoundation zebra Zebra zebrad 6.4.0 before 7.0.0 Denial of Service via Mempool Coinbase-Maturity Check CVE-2026-123554 8.7 HighNovember 8, 2026
• zcashfoundation zebra Zebra before 6.4.0 Gossiped Block Drop via Forged Coinbase scriptSig Height CVE-2026-109366 6.3 MediumOctober 12, 2026
• zcashfoundation zebra Zebra before 6.4.0 Denial of Service via Same-Hash Forged Block Bodies CVE-2026-109365 6.3 MediumOctober 12, 2026
• zcashfoundation zebra Zebra 2.3.0 before 6.4.0 Peer Ban Bypass via Exact-IP Keying CVE-2026-109364 6.9 MediumOctober 12, 2026
• zcashfoundation zebra Zebra 6.4.0 before 6.4.2 Denial of Service via Malformed v6 Transaction CVE-2026-109363 8.7 HighOctober 12, 2026
• zcashfoundation zebra Zebra before 6.3.0 False Readiness via Discarded One-Hash FindBlocks Response CVE-2026-104432 6.9 MediumOctober 2, 2026
• zcashfoundation zebra Zebra before 6.0.0 Denial of Service via Synchronous Script FFI Verification CVE-2026-104431 8.7 HighOctober 2, 2026
• zcashfoundation zebra Zebra 4.5.0 Consensus Split via P2SH Sigop Overcount CVE-2026-104430 8.7 HighOctober 2, 2026
• zcashfoundation zebra Zebra before 6.0.0-rc.0 Per-Peer Mempool Admission Bypass via P2P tx Messages CVE-2026-104429 6.9 MediumOctober 2, 2026
• zcashfoundation zebra Zebra before 11.0.0 Denial of Service via getblock Verbosity 2 CVE-2026-104428 6.9 MediumOctober 2, 2026
• zcashfoundation zebra Zebra before 6.1.0 Chain Stall via Stale parent_error_map Entry CVE-2026-104427 8.2 HighOctober 2, 2026
• zcashfoundation zebra Zebra before 6.1.0 Quadratic Complexity DoS via Block Transparent Value Check CVE-2026-104426 8.2 HighOctober 2, 2026
• zcashfoundation zebra Zebra before 6.1.0 Batch-Verification Poisoning DoS via Unattributed Pushed Transactions CVE-2026-104425 6.9 MediumOctober 2, 2026
• zcashfoundation zebra Zebra before 6.1.0 Incorrect Block Size Calculation in getblocktemplate CVE-2026-104424 6.3 MediumOctober 2, 2026
• zcashfoundation zebra Zebra before 6.2.1 Denial of Service via Uncapped V6 Shielded Proof Verification CVE-2026-104423 8.7 HighOctober 2, 2026
• zcashfoundation zebra Zebra before 6.3.0 Block Sync Denial of Service via Coinbase scriptSig Rewrite CVE-2026-104422 8.7 HighOctober 2, 2026
• zcashfoundation zebra Zebra before 6.2.1 Block Download Denial of Service via KnownBlock SentHashes Lockout CVE-2026-104421 6.9 MediumOctober 2, 2026
• zcashfoundation zebra Zebra before 6.3.0 Peer Misbehavior Ban Bypass via Gossiped Blocks CVE-2026-104420 6.9 MediumOctober 2, 2026
• zcashfoundation zebra Zebra before 6.3.0 Honest Peer Banning via Far-Ahead FindBlocks Hashes CVE-2026-104419 6.3 MediumOctober 2, 2026
• zcash orchard, zcash, zcashfoundation zebra +2 more +4 more Missing copy constraint in halo2_gadgets variable-base scalar multiplication allows under-constrained base, breaking Orchard Action circuit soundness CVE-2026-54496 Fix available 9.3 CriticalJuly 6, 2026
• zcashfoundation zebra ZEBRA: IPv4-Mapped Mempool Misbehavior Update Aborts Zebra Address Book CVE-2026-52829 Fix available 7.5 HighJuly 2, 2026
• zcashfoundation zebra ZEBRA: Unbounded memory leak in mempool download pipeline via timeout path cancel_handles retention CVE-2026-52734 Fix available 5.3 MediumJuly 2, 2026
• zcashfoundation zebra, zebra-state +1 more ZEBRA: Persistent on-disk corruption of Sapling/Orchard subtree roots after chain fork via pop_tip CVE-2026-52733 Fix available 6.5 MediumJuly 2, 2026
• zcashfoundation zebra, zebra-state +1 more ZEBRA: Repeated Non-Finalized Shielded Transaction Aborts Zebra Before Duplicate-Nullifier Rejection CVE-2026-52739 Fix available 5.9 MediumJuly 2, 2026
• zcashfoundation zebra, zebra-state +1 more ZEBRA: Finalized address balance credit-first overflow on consensus-valid blocks CVE-2026-52738 Fix available 6.9 MediumJuly 2, 2026
• zcashfoundation zebra, zebra-consensus +1 more ZEBRA: Sync restart poisoning from single unauthenticated peer via above-lookahead block CVE-2026-52737 Fix available 5.3 MediumJuly 2, 2026
• zcashfoundation zebra ZEBRA: Consensus divergence via P2SH sigop undercount in pure-Rust disabled-opcode parser CVE-2026-52735 Fix available 9.3 CriticalJuly 2, 2026
• zcashfoundation zebra ZEBRA: Block suppression via NU5 same-header body poisoning of sent-hash cache CVE-2026-52736 Fix available 8.7 HighJuly 2, 2026
• zcashfoundation zebra ZEBRA: Mempool transaction admission denial via single-peer inbound queue saturation CVE-2026-52732 Fix available 5.3 MediumJuly 2, 2026
• zcashfoundation zebra Zebra before 8.0.0 Denial of Service via z_listunifiedreceivers RPC CVE-2026-104434 Fix available 7.1 HighJuly 2, 2026
• zcashfoundation zebra, zebra-chain +1 more Zebra before 4.5.0 CPU Amplification via Uncapped getblocks/getheaders Locator Length CVE-2026-104436 Fix available 6.3 MediumJuly 2, 2026
• zcashfoundation zebra, zebra-rpc +1 more ZEBRA: Full node denial of service via non-ASCII LongPollId in getblocktemplate CVE-2026-52731 Fix available 6.5 MediumJuly 2, 2026
• zcashfoundation zebra Zebra 4.4.0 Consensus Divergence via V5 SIGHASH_SINGLE Without Output CVE-2026-104435 Fix available 8.3 HighMay 8, 2026
• zcashfoundation zebra ZEBRA: Permanent Block Discovery Halt via Gossip Queue Saturation and Syncer Poisoning CVE-2026-44499 Fix available 8.7 HighMay 8, 2026
• zcashfoundation zebra Zebra before 4.4.0 Consensus Split via SIGHASH_SINGLE Missing-Output Handling CVE-2026-104437 Fix available 8.3 HighMay 7, 2026
• zcashfoundation zebra, zfnd zebra-script, zebrad +2 more ZEBRA: Consensus Divergence in Transparent Sighash Hash-Type Handling due to Stale Buffer CVE-2026-44497 Fix available 9.3 CriticalMay 7, 2026
• zcashfoundation zebra, zfnd zebra-chain, zebra-network +1 more +3 more ZEBRA: Allocation Amplification in Inbound Network Deserializers CVE-2026-44500 Fix available 5.3 MediumMay 7, 2026
• zcashfoundation zebra, zfnd zebrad +1 more ZEBRA: Block Validator Undercounts Coinbase and P2SH Sigops CVE-2026-44498 Fix available 9.2 CriticalMay 7, 2026
• zcashfoundation zebra, zfnd zebra-script, zebrad +2 more ZEBRA: Consensus Divergence in Transparent Sighash Hash-Type Handling CVE-2026-41583 Fix available 9.3 CriticalApril 18, 2026
• zcashfoundation zebra, zfnd zebra-rpc, zebrad +2 more ZEBRA: Denial of Service via Interrupted JSON-RPC Requests from Authenticated Clients CVE-2026-41585 Fix available 6.9 MediumApril 18, 2026
• zcashfoundation zebra, zfnd zebra-chain, zebrad +2 more ZEBRA: rk Identity Point Panic in Transaction Verification CVE-2026-41584 Fix available 9.2 CriticalApril 18, 2026
• zcashfoundation zebra-network, zebrad +1 more Zebra: addr/addrv2 Deserialization Resource Exhaustion CVE-2026-40881 Fix available 6.3 MediumApril 18, 2026
• zcashfoundation zebra-consensus, zebrad +1 more Zebra: Cached Mempool Verification Bypasses Consensus Rules for Ahead-of-Tip Blocks CVE-2026-40880 Fix available 7.2 HighApril 18, 2026
• zcashfoundation zebra, zebra-consensus +1 more Zebra has a Consensus Failure due to Improper Verification of V5 Transactions CVE-2026-34377 Fix available 8.4 HighMarch 30, 2026
• Show olderLoading…