Zcashfoundation Zebra
20 CVEs affecting Zcashfoundation Zebra. Latest disclosed: 2026-08-18. Critical: 3, High: 5.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-54496 | Critical | 9.3 | 2026-07-17 | ZEBRA is a Zcash node written entirely in Rust. Prior to zebrad 5.0.0, halo2_gadgets 0.5.0, orchard 0.14.0, zcash_primitives 0.28.0, and zcashd 6.20.0, the var… |
CVE-2026-44497 | Critical | 9.1 | 2026-05-08 | ZEBRA is a Zcash node written entirely in Rust. Prior to zebrad version 4.4.0 and prior to zebra-script version 6.0.0, the fix for CVE-2026-41583 introduced a… |
CVE-2026-41583 | Critical | 9.1 | 2026-05-08 | ZEBRA is a Zcash node written entirely in Rust. Prior to zebrad version 4.3.1 and prior to zebra-script version 5.0.2, after a refactoring, Zebra failed to val… |
CVE-2026-34377 | High | 8.1 | 2026-03-31 | ZEBRA is a Zcash node written entirely in Rust. Prior to zebrad version 4.3.0 and zebra-consensus version 5.0.1, a logic error in Zebra's transaction verificat… |
CVE-2026-52829 | High | 7.5 | 2026-08-18 | ZEBRA is a Zcash node written entirely in Rust. Prior to 4.5.0, an unauthenticated IPv4 peer can deterministically terminate a synced Zebra node using the defa… |
CVE-2026-44498 | High | 7.5 | 2026-05-08 | ZEBRA is a Zcash node written entirely in Rust. Prior to version 4.4.0, Zebra's block validator undercounts transparent signature operations against the 20000-… |
CVE-2026-41584 | High | 7.5 | 2026-05-08 | ZEBRA is a Zcash node written entirely in Rust. Prior to zebrad version 4.3.1 and prior to zebra-chain version 6.0.2, Orchard transactions contain a rk field w… |
CVE-2026-34202 | High | 7.5 | 2026-03-31 | ZEBRA is a Zcash node written entirely in Rust. Prior to zebrad version 4.3.0 and zebra-chain version 6.0.1, a vulnerability in Zebra's transaction processing… |
CVE-2026-52733 | Medium | 6.5 | 2026-08-18 | ZEBRA is a Zcash node written entirely in Rust. Prior to 4.5.0, a natural or attacker-influenced chain fork can leave stale Sapling and Orchard note-commitment… |
CVE-2026-52731 | Medium | 6.5 | 2026-08-18 | ZEBRA is a Zcash node written entirely in Rust. Prior to 4.5.0, an attacker authenticated to an enabled Zebra RPC endpoint can terminate zebrad by supplying a… |
CVE-2026-41585 | Medium | 6.5 | 2026-05-08 | ZEBRA is a Zcash node written entirely in Rust. From zebrad versions 2.2.0 to before 4.3.1 and from zebra-rpc versions 1.0.0-beta.45 to before 6.0.2, a vulnera… |
CVE-2026-52739 | Medium | 5.9 | 2026-08-18 | ZEBRA is a Zcash node written entirely in Rust. Prior to 4.5.0, a malicious block producer can terminate zebrad by placing the same shielded transaction in a n… |
CVE-2026-52737 | Medium | 5.3 | 2026-08-18 | ZEBRA is a Zcash node written entirely in Rust. Prior to 4.5.0, a malicious unauthenticated P2P peer can answer Zebra's outbound getblocks or FindBlocks reques… |
CVE-2026-52734 | Medium | 5.3 | 2026-08-18 | ZEBRA is a Zcash node written entirely in Rust. Prior to 4.5.0, an unauthenticated P2P peer can cause the mempool download pipeline to retain transactions afte… |
CVE-2026-52732 | Medium | 5.3 | 2026-08-18 | ZEBRA is a Zcash node written entirely in Rust. Prior to 4.5.0, one unauthenticated P2P peer can monopolize all 25 MAX_INBOUND_CONCURRENCY slots in Zebra's inb… |
CVE-2026-44500 | Medium | 5.3 | 2026-05-08 | ZEBRA is a Zcash node written entirely in Rust. Prior to zebrad version 4.4.0, prior to zebra-chain version 7.0.0, and prior to zebra-network version 6.0.0, se… |
CVE-2026-52738 | | 2026-08-18 | ZEBRA is a Zcash node written entirely in Rust. Prior to 4.5.0, a consensus-valid block containing a long chain of transparent self-spends to one address can p… | |
CVE-2026-52736 | | 2026-08-18 | ZEBRA is a Zcash node written entirely in Rust. Prior to 4.5.0, a remote unauthenticated P2P peer can stall a Zebra node by racing an invalid block body agains… | |
CVE-2026-52735 | | 2026-08-18 | ZEBRA is a Zcash node written entirely in Rust. Prior to 4.5.0, Zebra can accept a block that zcashd rejects because the P2SH signature-operation counter under… | |
CVE-2026-44499 | | 2026-05-08 | ZEBRA is a Zcash node written entirely in Rust. Prior to version 4.4.0, a composite denial-of-service vulnerability in Zebra's block discovery pipeline allows… |