Resource exhaustion in Zcashfoundation Zebrad
CVE-2026-40881
ZEBRA is a Zcash node written entirely in Rust. Prior to zebrad version 4.3.0 and zebra-network version 5.0.1, when deserializing addr or addrv2 messages, which contain vectors of addresses, Zebra would fully deserialize them up to a maxim…
EPSS: 0.001 (19.1th percentile) — read the EPSS interpretation.
Affected products
- Zcashfoundation Zebrad — versions < 4.3.1
- Zcashfoundation Zebra-network — versions < 5.0.1
Weakness classification (CWE)
References
- https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-xr93-pcq3-pxf8 (x_refsource_CONFIRM)