ZE
Product
zebra
by ZcashFoundation · last CVE Oct 12, 2026
42
CVEs
0
On KEV
9.3
Max CVSS
22
New 30D
Severity mix
Critical 4High 14Medium 20Low 4
Watch

Add zebra to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-52738
6.9
1%
Aug 18
ZEBRA: Finalized address balance credit-first overflow on consensus-valid blocks
Affected: < 4.5.0
CVE-2026-104434
6.5
0%
Oct 2
Zebra before 8.0.0 Denial of Service via z_listunifiedreceivers RPC
Affected: before 8.0.0; before 4.5.0
CVE-2026-52731
6.5
1%
Aug 18
ZEBRA: Full node denial of service via non-ASCII LongPollId in getblocktemplate
Affected: < 4.5.0
CVE-2026-52733
6.5
0%
Aug 18
ZEBRA: Persistent on-disk corruption of Sapling/Orchard subtree roots after chain fork via pop_tip
Affected: < 4.5.0
CVE-2026-41585
6.5
0%
May 8
ZEBRA: Denial of Service via Interrupted JSON-RPC Requests from Authenticated Clients
Affected: zebra-rpc >= 1.0.0-beta.45, < 6.0.2; zebrad >= 2.2.0, < 4.3.1
CVE-2026-104427
5.9
0%
Oct 2
Zebra before 6.1.0 Chain Stall via Stale parent_error_map Entry
Affected: before 6.1.0
CVE-2026-104426
5.9
0%
Oct 2
Zebra before 6.1.0 Quadratic Complexity DoS via Block Transparent Value Check
Affected: before 6.1.0
CVE-2026-52739
5.9
1%
Aug 18
ZEBRA: Repeated Non-Finalized Shielded Transaction Aborts Zebra Before Duplicate-Nullifier Rejection
Affected: < 4.5.0
CVE-2026-109364
5.3
0%
Oct 12
Zebra 2.3.0 before 6.4.0 Peer Ban Bypass via Exact-IP Keying
Affected: 2.3.0 before 6.4.0
CVE-2026-104432
5.3
0%
Oct 2
Zebra before 6.3.0 False Readiness via Discarded One-Hash FindBlocks Response
Affected: before 6.3.0
CVE-2026-104429
5.3
0%
Oct 2
Zebra before 6.0.0-rc.0 Per-Peer Mempool Admission Bypass via P2P tx Messages
Affected: before 6.0.0-rc.0
CVE-2026-104428
5.3
0%
Oct 2
Zebra before 11.0.0 Denial of Service via getblock Verbosity 2
Affected: before 11.0.0
CVE-2026-104425
5.3
0%
Oct 2
Zebra before 6.1.0 Batch-Verification Poisoning DoS via Unattributed Pushed Transactions
Affected: before 6.1.0
CVE-2026-104421
5.3
0%
Oct 2
Zebra before 6.2.1 Block Download Denial of Service via KnownBlock SentHashes Lockout
Affected: before 6.2.1
CVE-2026-104420
5.3
0%
Oct 2
Zebra before 6.3.0 Peer Misbehavior Ban Bypass via Gossiped Blocks
Affected: before 6.3.0
CVE-2026-52732
5.3
1%
Aug 18
ZEBRA: Mempool transaction admission denial via single-peer inbound queue saturation
Affected: < 4.5.0
CVE-2026-52734
5.3
1%
Aug 18
ZEBRA: Unbounded memory leak in mempool download pipeline via timeout path cancel_handles retention
Affected: < 4.5.0
CVE-2026-52737
5.3
0%
Aug 18
ZEBRA: Sync restart poisoning from single unauthenticated peer via above-lookahead block
Affected: < 4.5.0
CVE-2026-44500
5.3
0%
May 8
ZEBRA: Allocation Amplification in Inbound Network Deserializers
Affected: zebrad < 4.4.0; zebra-chain < 7.0.0; zebra-network < 6.0.0
CVE-2026-104419
4.8
0%
Oct 2
Zebra before 6.3.0 Honest Peer Banning via Far-Ahead FindBlocks Hashes
Affected: before 6.3.0
Showing 20