ZC
Vendor
ZcashFoundation
53
CVEs
0
On KEV
22
New 30D
Products
ZE9.3
zebra
ZcashFoundation
42 CVEs0 on KEV22 new
ZE8.1
zebra-consensus
ZcashFoundation
3 CVEs0 on KEV0 new
ZE6.9
zebra-state
ZcashFoundation
3 CVEs0 on KEV0 new
ZE8.1
zebrad
ZcashFoundation
2 CVEs0 on KEV0 new
ZE7.5
zebra-chain
ZcashFoundation
1 CVEs0 on KEV0 new
ZE7.5
zebra-network
ZcashFoundation
1 CVEs0 on KEV0 new
ZE6.5
zebra-rpc
ZcashFoundation
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-109366 | ZE zebra ZcashFoundation | 3.7 | Oct 12 | Zebra before 6.4.0 Gossiped Block Drop via Forged Coinbase scriptSig Height |
| CVE-2026-109365 | ZE zebra ZcashFoundation | 3.7 | Oct 12 | Zebra before 6.4.0 Denial of Service via Same-Hash Forged Block Bodies |
| CVE-2026-109364 | ZE zebra ZcashFoundation | 5.3 | Oct 12 | Zebra 2.3.0 before 6.4.0 Peer Ban Bypass via Exact-IP Keying |
| CVE-2026-109363 | ZE zebra ZcashFoundation | 7.5 | Oct 12 | Zebra 6.4.0 before 6.4.2 Denial of Service via Malformed v6 Transaction |
| CVE-2026-104437 | ZE zebra ZcashFoundation | 7.4 | Oct 2 | Zebra before 4.4.0 Consensus Split via SIGHASH_SINGLE Missing-Output Handling |
| CVE-2026-104436 | ZE zebra ZcashFoundation | 3.7 | Oct 2 | Zebra before 4.5.0 CPU Amplification via Uncapped getblocks/getheaders Locator Length |
| CVE-2026-104435 | ZE zebra ZcashFoundation | 7.4 | Oct 2 | Zebra 4.4.0 Consensus Divergence via V5 SIGHASH_SINGLE Without Output |
| CVE-2026-104434 | ZE zebra ZcashFoundation | 6.5 | Oct 2 | Zebra before 8.0.0 Denial of Service via z_listunifiedreceivers RPC |
| CVE-2026-104432 | ZE zebra ZcashFoundation | 5.3 | Oct 2 | Zebra before 6.3.0 False Readiness via Discarded One-Hash FindBlocks Response |
| CVE-2026-104431 | ZE zebra ZcashFoundation | 7.5 | Oct 2 | Zebra before 6.0.0 Denial of Service via Synchronous Script FFI Verification |
| CVE-2026-104430 | ZE zebra ZcashFoundation | 7.5 | Oct 2 | Zebra 4.5.0 Consensus Split via P2SH Sigop Overcount |
| CVE-2026-104429 | ZE zebra ZcashFoundation | 5.3 | Oct 2 | Zebra before 6.0.0-rc.0 Per-Peer Mempool Admission Bypass via P2P tx Messages |
| CVE-2026-104428 | ZE zebra ZcashFoundation | 5.3 | Oct 2 | Zebra before 11.0.0 Denial of Service via getblock Verbosity 2 |
| CVE-2026-104427 | ZE zebra ZcashFoundation | 5.9 | Oct 2 | Zebra before 6.1.0 Chain Stall via Stale parent_error_map Entry |
| CVE-2026-104426 | ZE zebra ZcashFoundation | 5.9 | Oct 2 | Zebra before 6.1.0 Quadratic Complexity DoS via Block Transparent Value Check |
| CVE-2026-104425 | ZE zebra ZcashFoundation | 5.3 | Oct 2 | Zebra before 6.1.0 Batch-Verification Poisoning DoS via Unattributed Pushed Transactions |
| CVE-2026-104424 | ZE zebra ZcashFoundation | 3.7 | Oct 2 | Zebra before 6.1.0 Incorrect Block Size Calculation in getblocktemplate |
| CVE-2026-104423 | ZE zebra ZcashFoundation | 7.5 | Oct 2 | Zebra before 6.2.1 Denial of Service via Uncapped V6 Shielded Proof Verification |
| CVE-2026-104422 | ZE zebra ZcashFoundation | 7.5 | Oct 2 | Zebra before 6.3.0 Block Sync Denial of Service via Coinbase scriptSig Rewrite |
| CVE-2026-104421 | ZE zebra ZcashFoundation | 5.3 | Oct 2 | Zebra before 6.2.1 Block Download Denial of Service via KnownBlock SentHashes Lockout |
| CVE-2026-104420 | ZE zebra ZcashFoundation | 5.3 | Oct 2 | Zebra before 6.3.0 Peer Misbehavior Ban Bypass via Gossiped Blocks |
| CVE-2026-104419 | ZE zebra ZcashFoundation | 4.8 | Oct 2 | Zebra before 6.3.0 Honest Peer Banning via Far-Ahead FindBlocks Hashes |
| CVE-2026-52829 | ZE zebra ZcashFoundation | 7.5 | Aug 18 | ZEBRA: IPv4-Mapped Mempool Misbehavior Update Aborts Zebra Address Book |
| CVE-2026-52736 | ZE zebra ZcashFoundation | 8.7 | Aug 18 | ZEBRA: Block suppression via NU5 same-header body poisoning of sent-hash cache |
| CVE-2026-52732 | ZE zebra ZcashFoundation | 5.3 | Aug 18 | ZEBRA: Mempool transaction admission denial via single-peer inbound queue saturation |
| CVE-2026-52731 | ZE zebra ZcashFoundation | 6.5 | Aug 18 | ZEBRA: Full node denial of service via non-ASCII LongPollId in getblocktemplate |
| CVE-2026-52733 | ZE zebra-state ZcashFoundation | 6.5 | Aug 18 | ZEBRA: Persistent on-disk corruption of Sapling/Orchard subtree roots after chain fork via pop_tip |
| CVE-2026-52738 | ZE zebra-state ZcashFoundation | 6.9 | Aug 18 | ZEBRA: Finalized address balance credit-first overflow on consensus-valid blocks |
| CVE-2026-52735 | ZE zebra ZcashFoundation | 9.3 | Aug 18 | ZEBRA: Consensus divergence via P2SH sigop undercount in pure-Rust disabled-opcode parser |
| CVE-2026-52739 | ZE zebra ZcashFoundation | 5.9 | Aug 18 | ZEBRA: Repeated Non-Finalized Shielded Transaction Aborts Zebra Before Duplicate-Nullifier Rejection |
| CVE-2026-52734 | ZE zebra ZcashFoundation | 5.3 | Aug 18 | ZEBRA: Unbounded memory leak in mempool download pipeline via timeout path cancel_handles retention |
| CVE-2026-52737 | ZE zebra-consensus ZcashFoundation | 5.3 | Aug 18 | ZEBRA: Sync restart poisoning from single unauthenticated peer via above-lookahead block |
| CVE-2026-54496 | ZE zebra ZcashFoundation | 9.3 | Jul 17 | Missing copy constraint in halo2_gadgets variable-base scalar multiplication allows under-constrained base, breaking Orchard Action circuit soundness |
| CVE-2026-44499 | ZE zebra ZcashFoundation | 8.7 | May 8 | ZEBRA: Permanent Block Discovery Halt via Gossip Queue Saturation and Syncer Poisoning |
| CVE-2026-44500 | ZE zebra ZcashFoundation | 5.3 | May 8 | ZEBRA: Allocation Amplification in Inbound Network Deserializers |
| CVE-2026-44498 | ZE zebra ZcashFoundation | 7.5 | May 8 | ZEBRA: Block Validator Undercounts Coinbase and P2SH Sigops |
| CVE-2026-44497 | ZE zebra ZcashFoundation | 9.1 | May 8 | ZEBRA: Consensus Divergence in Transparent Sighash Hash-Type Handling due to Stale Buffer |
| CVE-2026-41585 | ZE zebra ZcashFoundation | 6.5 | May 8 | ZEBRA: Denial of Service via Interrupted JSON-RPC Requests from Authenticated Clients |
| CVE-2026-41584 | ZE zebra ZcashFoundation | 7.5 | May 8 | ZEBRA: rk Identity Point Panic in Transaction Verification |
| CVE-2026-41583 | ZE zebra ZcashFoundation | 9.1 | May 8 | ZEBRA: Consensus Divergence in Transparent Sighash Hash-Type Handling |
| CVE-2026-40881 | ZE zebra-network ZcashFoundation | 7.5 | Apr 21 | Zebra: addr/addrv2 Deserialization Resource Exhaustion |
| CVE-2026-40880 | ZE zebra-consensus ZcashFoundation | 8.1 | Apr 21 | Zebra: Cached Mempool Verification Bypasses Consensus Rules for Ahead-of-Tip Blocks |
| CVE-2026-34377 | ZE zebra ZcashFoundation | 8.1 | Mar 31 | Zebra has a Consensus Failure due to Improper Verification of V5 Transactions |
| CVE-2026-34202 | ZE zebra ZcashFoundation | 7.5 | Mar 31 | Zebra node crash — V5 transaction hash panic (P2P reachable) |