ZE
Product
zebra
by ZcashFoundation · last CVE Oct 12, 2026
42
CVEs
0
On KEV
9.3
Max CVSS
22
New 30D
Severity mix
Critical 4High 14Medium 20Low 4
Watch

Add zebra to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-52735
9.3
1%
Aug 18
ZEBRA: Consensus divergence via P2SH sigop undercount in pure-Rust disabled-opcode parser
Affected: < 4.5.0
CVE-2026-54496
9.3
0%
Jul 17
Missing copy constraint in halo2_gadgets variable-base scalar multiplication allows under-constrained base, breaking Orchard Action circuit soundness
Affected: < 5.0.0
CVE-2026-44497
9.1
0%
May 8
ZEBRA: Consensus Divergence in Transparent Sighash Hash-Type Handling due to Stale Buffer
Affected: zebra-script < 6.0.0; zebrad < 4.4.0
CVE-2026-41583
9.1
0%
May 8
ZEBRA: Consensus Divergence in Transparent Sighash Hash-Type Handling
Affected: zebrad < 4.3.1; zebra-script < 5.0.2
CVE-2026-52736
8.7
1%
Aug 18
ZEBRA: Block suppression via NU5 same-header body poisoning of sent-hash cache
Affected: < 4.5.0
CVE-2026-44499
8.7
0%
May 8
ZEBRA: Permanent Block Discovery Halt via Gossip Queue Saturation and Syncer Poisoning
Affected: < 4.4.0
CVE-2026-34377
8.1
0%
Mar 31
Zebra has a Consensus Failure due to Improper Verification of V5 Transactions
Affected: < 4.3.0
CVE-2026-109363
7.5
0%
Oct 12
Zebra 6.4.0 before 6.4.2 Denial of Service via Malformed v6 Transaction
Affected: 6.4.0 before 6.4.2
CVE-2026-104431
7.5
0%
Oct 2
Zebra before 6.0.0 Denial of Service via Synchronous Script FFI Verification
Affected: before 6.0.0
CVE-2026-104430
7.5
0%
Oct 2
Zebra 4.5.0 Consensus Split via P2SH Sigop Overcount
Affected: 4.5.0 before 4.5.1; 7.0.0 before 7.0.1
CVE-2026-104423
7.5
0%
Oct 2
Zebra before 6.2.1 Denial of Service via Uncapped V6 Shielded Proof Verification
Affected: before 6.2.1
CVE-2026-104422
7.5
0%
Oct 2
Zebra before 6.3.0 Block Sync Denial of Service via Coinbase scriptSig Rewrite
Affected: before 6.3.0
CVE-2026-52829
7.5
1%
Aug 18
ZEBRA: IPv4-Mapped Mempool Misbehavior Update Aborts Zebra Address Book
Affected: < 4.5.0
CVE-2026-44498
7.5
0%
May 8
ZEBRA: Block Validator Undercounts Coinbase and P2SH Sigops
Affected: < 4.4.0
CVE-2026-41584
7.5
0%
May 8
ZEBRA: rk Identity Point Panic in Transaction Verification
Affected: zebra-chain < 6.0.2; zebrad < 4.3.1
CVE-2026-34202
7.5
1%
Mar 31
Zebra node crash — V5 transaction hash panic (P2P reachable)
Affected: < 4.3.0
CVE-2026-104437
7.4
0%
Oct 2
Zebra before 4.4.0 Consensus Split via SIGHASH_SINGLE Missing-Output Handling
Affected: before 4.4.0
CVE-2026-104435
7.4
0%
Oct 2
Zebra 4.4.0 Consensus Divergence via V5 SIGHASH_SINGLE Without Output
Affected: 4.4.0 before 4.4.1; 6.0.0 before 6.0.1
CVE-2026-52738
6.9
1%
Aug 18
ZEBRA: Finalized address balance credit-first overflow on consensus-valid blocks
Affected: < 4.5.0
CVE-2026-104434
6.5
0%
Oct 2
Zebra before 8.0.0 Denial of Service via z_listunifiedreceivers RPC
Affected: before 8.0.0; before 4.5.0
CVE-2026-52731
6.5
1%
Aug 18
ZEBRA: Full node denial of service via non-ASCII LongPollId in getblocktemplate
Affected: < 4.5.0
CVE-2026-52733
6.5
0%
Aug 18
ZEBRA: Persistent on-disk corruption of Sapling/Orchard subtree roots after chain fork via pop_tip
Affected: < 4.5.0
CVE-2026-41585
6.5
0%
May 8
ZEBRA: Denial of Service via Interrupted JSON-RPC Requests from Authenticated Clients
Affected: zebra-rpc >= 1.0.0-beta.45, < 6.0.2; zebrad >= 2.2.0, < 4.3.1
CVE-2026-104427
5.9
0%
Oct 2
Zebra before 6.1.0 Chain Stall via Stale parent_error_map Entry
Affected: before 6.1.0
CVE-2026-104426
5.9
0%
Oct 2
Zebra before 6.1.0 Quadratic Complexity DoS via Block Transparent Value Check
Affected: before 6.1.0
CVE-2026-52739
5.9
1%
Aug 18
ZEBRA: Repeated Non-Finalized Shielded Transaction Aborts Zebra Before Duplicate-Nullifier Rejection
Affected: < 4.5.0
CVE-2026-109364
5.3
0%
Oct 12
Zebra 2.3.0 before 6.4.0 Peer Ban Bypass via Exact-IP Keying
Affected: 2.3.0 before 6.4.0
CVE-2026-104432
5.3
0%
Oct 2
Zebra before 6.3.0 False Readiness via Discarded One-Hash FindBlocks Response
Affected: before 6.3.0
CVE-2026-104429
5.3
0%
Oct 2
Zebra before 6.0.0-rc.0 Per-Peer Mempool Admission Bypass via P2P tx Messages
Affected: before 6.0.0-rc.0
CVE-2026-104428
5.3
0%
Oct 2
Zebra before 11.0.0 Denial of Service via getblock Verbosity 2
Affected: before 11.0.0
CVE-2026-104425
5.3
0%
Oct 2
Zebra before 6.1.0 Batch-Verification Poisoning DoS via Unattributed Pushed Transactions
Affected: before 6.1.0
CVE-2026-104421
5.3
0%
Oct 2
Zebra before 6.2.1 Block Download Denial of Service via KnownBlock SentHashes Lockout
Affected: before 6.2.1
CVE-2026-104420
5.3
0%
Oct 2
Zebra before 6.3.0 Peer Misbehavior Ban Bypass via Gossiped Blocks
Affected: before 6.3.0
CVE-2026-52732
5.3
1%
Aug 18
ZEBRA: Mempool transaction admission denial via single-peer inbound queue saturation
Affected: < 4.5.0
CVE-2026-52734
5.3
1%
Aug 18
ZEBRA: Unbounded memory leak in mempool download pipeline via timeout path cancel_handles retention
Affected: < 4.5.0
CVE-2026-52737
5.3
0%
Aug 18
ZEBRA: Sync restart poisoning from single unauthenticated peer via above-lookahead block
Affected: < 4.5.0
CVE-2026-44500
5.3
0%
May 8
ZEBRA: Allocation Amplification in Inbound Network Deserializers
Affected: zebrad < 4.4.0; zebra-chain < 7.0.0; zebra-network < 6.0.0
CVE-2026-104419
4.8
0%
Oct 2
Zebra before 6.3.0 Honest Peer Banning via Far-Ahead FindBlocks Hashes
Affected: before 6.3.0
CVE-2026-109366
3.7
0%
Oct 12
Zebra before 6.4.0 Gossiped Block Drop via Forged Coinbase scriptSig Height
Affected: before 6.4.0
CVE-2026-109365
3.7
0%
Oct 12
Zebra before 6.4.0 Denial of Service via Same-Hash Forged Block Bodies
Affected: before 6.4.0
CVE-2026-104436
3.7
0%
Oct 2
Zebra before 4.5.0 CPU Amplification via Uncapped getblocks/getheaders Locator Length
Affected: before 4.5.0; before 8.0.0
CVE-2026-104424
3.7
0%
Oct 2
Zebra before 6.1.0 Incorrect Block Size Calculation in getblocktemplate
Affected: before 6.1.0
Showing 42