Skip to contentZcashfoundation Zebra vulnerabilities
- zcashfoundation zebraZebra before 7.0.0 Sync Denial of Service via Forged Checkpoint Block BodyCVE-2026-1235608.7 High
- zcashfoundation zebraZebra before 7.0.0 Denial of Service via Quadratic Sighash ComputationCVE-2026-1235598.7 High
- zcashfoundation zebraZebra before 7.0.0 Checkpoint Sync Denial of Service via Cancelled Verifier RewindCVE-2026-1235588.7 High
- zcashfoundation zebraZebra zebrad before 7.0.0 Reachable Assertion DoS via Peer DisconnectionCVE-2026-1235578.2 High
- zcashfoundation zebraZebra 4.5.0 before 7.0.0 Honest Peer Ban via Mempool Lock-Time ScoringCVE-2026-1235566.9 Medium
- zcashfoundation zebraZebra 2.3.0 before 7.0.0 Denial of Service via Unscored Script Verification FailuresCVE-2026-1235558.7 High
- zcashfoundation zebraZebra zebrad 6.4.0 before 7.0.0 Denial of Service via Mempool Coinbase-Maturity CheckCVE-2026-1235548.7 High
- zcashfoundation zebraZebra before 6.4.0 Gossiped Block Drop via Forged Coinbase scriptSig HeightCVE-2026-1093666.3 Medium
- zcashfoundation zebraZebra before 6.4.0 Denial of Service via Same-Hash Forged Block BodiesCVE-2026-1093656.3 Medium
- zcashfoundation zebraZebra 2.3.0 before 6.4.0 Peer Ban Bypass via Exact-IP KeyingCVE-2026-1093646.9 Medium
- zcashfoundation zebraZebra 6.4.0 before 6.4.2 Denial of Service via Malformed v6 TransactionCVE-2026-1093638.7 High
- zcashfoundation zebraZebra before 6.3.0 False Readiness via Discarded One-Hash FindBlocks ResponseCVE-2026-1044326.9 Medium
- zcashfoundation zebraZebra before 6.0.0 Denial of Service via Synchronous Script FFI VerificationCVE-2026-1044318.7 High
- zcashfoundation zebraZebra 4.5.0 Consensus Split via P2SH Sigop OvercountCVE-2026-1044308.7 High
- zcashfoundation zebraZebra before 6.0.0-rc.0 Per-Peer Mempool Admission Bypass via P2P tx MessagesCVE-2026-1044296.9 Medium
- zcashfoundation zebraZebra before 11.0.0 Denial of Service via getblock Verbosity 2CVE-2026-1044286.9 Medium
- zcashfoundation zebraZebra before 6.1.0 Chain Stall via Stale parent_error_map EntryCVE-2026-1044278.2 High
- zcashfoundation zebraZebra before 6.1.0 Quadratic Complexity DoS via Block Transparent Value CheckCVE-2026-1044268.2 High
- zcashfoundation zebraZebra before 6.1.0 Batch-Verification Poisoning DoS via Unattributed Pushed TransactionsCVE-2026-1044256.9 Medium
- zcashfoundation zebraZebra before 6.1.0 Incorrect Block Size Calculation in getblocktemplateCVE-2026-1044246.3 Medium
- zcashfoundation zebraZebra before 6.2.1 Denial of Service via Uncapped V6 Shielded Proof VerificationCVE-2026-1044238.7 High
- zcashfoundation zebraZebra before 6.3.0 Block Sync Denial of Service via Coinbase scriptSig RewriteCVE-2026-1044228.7 High
- zcashfoundation zebraZebra before 6.2.1 Block Download Denial of Service via KnownBlock SentHashes LockoutCVE-2026-1044216.9 Medium
- zcashfoundation zebraZebra before 6.3.0 Peer Misbehavior Ban Bypass via Gossiped BlocksCVE-2026-1044206.9 Medium
- zcashfoundation zebraZebra before 6.3.0 Honest Peer Banning via Far-Ahead FindBlocks HashesCVE-2026-1044196.3 Medium
- zcash orchard, zcash, zcashfoundation zebra +2 more +4 moreMissing copy constraint in halo2_gadgets variable-base scalar multiplication allows under-constrained base, breaking Orchard Action circuit soundnessCVE-2026-54496Fix available9.3 Critical
- zcashfoundation zebraZEBRA: IPv4-Mapped Mempool Misbehavior Update Aborts Zebra Address BookCVE-2026-52829Fix available7.5 High
- zcashfoundation zebraZEBRA: Unbounded memory leak in mempool download pipeline via timeout path cancel_handles retentionCVE-2026-52734Fix available5.3 Medium
- zcashfoundation zebra, zebra-state +1 moreZEBRA: Persistent on-disk corruption of Sapling/Orchard subtree roots after chain fork via pop_tipCVE-2026-52733Fix available6.5 Medium
- zcashfoundation zebra, zebra-state +1 moreZEBRA: Repeated Non-Finalized Shielded Transaction Aborts Zebra Before Duplicate-Nullifier RejectionCVE-2026-52739Fix available5.9 Medium
- zcashfoundation zebra, zebra-state +1 moreZEBRA: Finalized address balance credit-first overflow on consensus-valid blocksCVE-2026-52738Fix available6.9 Medium
- zcashfoundation zebra, zebra-consensus +1 moreZEBRA: Sync restart poisoning from single unauthenticated peer via above-lookahead blockCVE-2026-52737Fix available5.3 Medium
- zcashfoundation zebraZEBRA: Consensus divergence via P2SH sigop undercount in pure-Rust disabled-opcode parserCVE-2026-52735Fix available9.3 Critical
- zcashfoundation zebraZEBRA: Block suppression via NU5 same-header body poisoning of sent-hash cacheCVE-2026-52736Fix available8.7 High
- zcashfoundation zebraZEBRA: Mempool transaction admission denial via single-peer inbound queue saturationCVE-2026-52732Fix available5.3 Medium
- zcashfoundation zebraZebra before 8.0.0 Denial of Service via z_listunifiedreceivers RPCCVE-2026-104434Fix available7.1 High
- zcashfoundation zebra, zebra-chain +1 moreZebra before 4.5.0 CPU Amplification via Uncapped getblocks/getheaders Locator LengthCVE-2026-104436Fix available6.3 Medium
- zcashfoundation zebra, zebra-rpc +1 moreZEBRA: Full node denial of service via non-ASCII LongPollId in getblocktemplateCVE-2026-52731Fix available6.5 Medium
- zcashfoundation zebraZebra 4.4.0 Consensus Divergence via V5 SIGHASH_SINGLE Without OutputCVE-2026-104435Fix available8.3 High
- zcashfoundation zebraZEBRA: Permanent Block Discovery Halt via Gossip Queue Saturation and Syncer PoisoningCVE-2026-44499Fix available8.7 High
- zcashfoundation zebraZebra before 4.4.0 Consensus Split via SIGHASH_SINGLE Missing-Output HandlingCVE-2026-104437Fix available8.3 High
- zcashfoundation zebra, zfnd zebra-script, zebrad +2 moreZEBRA: Consensus Divergence in Transparent Sighash Hash-Type Handling due to Stale BufferCVE-2026-44497Fix available9.3 Critical
- zcashfoundation zebra, zfnd zebra-chain, zebra-network +1 more +3 moreZEBRA: Allocation Amplification in Inbound Network DeserializersCVE-2026-44500Fix available5.3 Medium
- zcashfoundation zebra, zfnd zebrad +1 moreZEBRA: Block Validator Undercounts Coinbase and P2SH SigopsCVE-2026-44498Fix available9.2 Critical
- zcashfoundation zebra, zfnd zebra-script, zebrad +2 moreZEBRA: Consensus Divergence in Transparent Sighash Hash-Type HandlingCVE-2026-41583Fix available9.3 Critical
- zcashfoundation zebra, zfnd zebra-rpc, zebrad +2 moreZEBRA: Denial of Service via Interrupted JSON-RPC Requests from Authenticated ClientsCVE-2026-41585Fix available6.9 Medium
- zcashfoundation zebra, zfnd zebra-chain, zebrad +2 moreZEBRA: rk Identity Point Panic in Transaction VerificationCVE-2026-41584Fix available9.2 Critical
- zcashfoundation zebra-network, zebrad +1 moreZebra: addr/addrv2 Deserialization Resource ExhaustionCVE-2026-40881Fix available6.3 Medium
- zcashfoundation zebra-consensus, zebrad +1 moreZebra: Cached Mempool Verification Bypasses Consensus Rules for Ahead-of-Tip BlocksCVE-2026-40880Fix available7.2 High
- zcashfoundation zebra, zebra-consensus +1 moreZebra has a Consensus Failure due to Improper Verification of V5 TransactionsCVE-2026-34377Fix available8.4 High
- Show olderLoading…