Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 39

Export CSV
CVE-2026-123557

Zebra zebrad before 7.0.0 Reachable Assertion DoS via Peer Disconnection

ZcashFoundation Zebra zebrad before 7.0.0 contains a reachable assertion race condition that allows unauthenticated remote peers to abort the node by triggering disconnection during a blocked outbound send. Malicious peers can return empty FindBlocks or FindHeaders replies and stop reading their socket, dropping an unresolved MustUseClientResponseSender and terminating syncing nodes.

CVSS 4.0 · 8.2 High EPSS < 1% KEV · Not listed
Vendors
Zcashfoundation Zfnd
Products
Zebra Zebra
CVE-2026-123558

Zebra before 7.0.0 Checkpoint Sync Denial of Service via Cancelled Verifier Rewind

Zebra zebrad before 7.0.0 contains a denial of service vulnerability that allows a malicious peer to stall checkpoint sync by cancelling the verifier rewind after a failed commit. Attackers can serve a forged block with altered authorizing data plus a restart-triggering block, leaving the verifier rejecting honest blocks until restart.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Zfnd
Products
Zebra
CVE-2026-123554

Zebra zebrad 6.4.0 before 7.0.0 Denial of Service via Mempool Coinbase-Maturity Check

Zebra zebrad 6.4.0 before 7.0.0 performs quadratic work in the mempool coinbase-maturity check because Transaction::coinbase_spend_restriction() rebuilds the transaction's output list once per spent outpoint. Any connected peer can repeatedly send unsigned transactions with many transparent inputs and outputs, which are rejected without a misbehavior score, to pin verification threads.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Zfnd
Products
Zebra
CVE-2026-123555

Zebra 2.3.0 before 7.0.0 Denial of Service via Unscored Script Verification Failures

Zebra from 2.3.0 before 7.0.0 contains a denial of service vulnerability that allows unauthenticated peers to evade misbehavior scoring by sending transactions or blocks with invalid transparent scripts. Attackers can flood mempool with script-failing transactions or serve forged v5 block bodies with altered scriptSig bytes to exhaust CPU and repeatedly stall block sync.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Zcashfoundation Zfnd
Products
Zebra Zebra
CVE-2026-123560

Zebra before 7.0.0 Sync Denial of Service via Forged Checkpoint Block Body

Zebra before 7.0.0 contains an incomplete cleanup vulnerability that allows unauthenticated peers to stall initial sync by serving a forged checkpoint block body. Attackers can supply a body with forged authorizing data near the final checkpoint, leaving rejected hashes in the sent-hash set so the node stops requesting blocks until restart.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Zfnd
Products
Zebra
CVE-2026-123559

Zebra before 7.0.0 Denial of Service via Quadratic Sighash Computation

Zebra before 7.0.0 contains an inefficient algorithmic complexity vulnerability that allows unauthenticated peers to exhaust verification threads by submitting transactions with many transparent inputs. Attackers can relay invalid transactions with tens of thousands of inputs, forcing quadratic ZIP-244 or ZIP-243 digest recomputation that stalls Rayon-backed block verification for minutes.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Zfnd
Products
Zebra
CVE-2026-123556

Zebra 4.5.0 before 7.0.0 Honest Peer Ban via Mempool Lock-Time Scoring

ZcashFoundation Zebra from 4.5.0 before 7.0.0 contains a protection mechanism failure that bans honest peers by scoring mempool lock-time rejections at the ban threshold. Attackers can broadcast transactions locked until the current height right after each block, causing lagging nodes to ban honest relaying peers for 24 hours or until restart.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Zfnd
Products
Zebra
CVE-2026-104436

Zebra before 4.5.0 CPU Amplification via Uncapped getblocks/getheaders Locator Length

Zebra before 4.5.0 contains an uncontrolled resource consumption vulnerability that allows remote P2P peers to exhaust blocking-pool threads by sending oversized block locator vectors. Attackers can send getblocks or getheaders messages with up to 65,535 locator hashes, triggering per-hash chain lookups that degrade block validation, RPC, and mempool performance.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Zcashfoundation Zfnd
Products
Zebra Zebra Zebra-chain
CVE-2026-109366

Zebra before 6.4.0 Gossiped Block Drop via Forged Coinbase scriptSig Height

Zebra before 6.4.0 contains an improper integrity validation vulnerability in the inbound gossip download path that allows unauthenticated peers to force dropping of new blocks without penalty. Attackers can serve a real block with a coinbase scriptSig rewritten to height 1, which keeps the ZIP-244 block hash, triggering a behind-tip drop before consensus validation and delaying tip discovery for mining backends.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Zcashfoundation Zfnd
Products
Zebra Zebra
CVE-2026-109365

Zebra before 6.4.0 Denial of Service via Same-Hash Forged Block Bodies

Zebra before 6.4.0 contains an uncontrolled resource consumption vulnerability that allows unauthenticated peers to force full proof verification by serving forged block bodies with valid header hashes. Attackers can flip authorizing-only bytes such as a coinbase scriptSig, wasting Sapling, Orchard, and Ironwood proof verification without penalty and stalling sync for 67 seconds.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Zcashfoundation Zfnd
Products
Zebra Zebra
CVE-2026-109364

Zebra 2.3.0 before 6.4.0 Peer Ban Bypass via Exact-IP Keying

Zebra 2.3.0 before 6.4.0 contains a protection mechanism failure that allows unauthenticated peers to evade bans because bans and misbehavior scores are keyed on exact IP addresses. Attackers can reconnect from fresh IPv6 addresses in their /64 allocation or flush the 20,000-entry FIFO ban list to restore access for banned peers.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Zcashfoundation Zfnd
Products
Zebra Zebra
CVE-2026-109363

Zebra 6.4.0 before 6.4.2 Denial of Service via Malformed v6 Transaction

ZcashFoundation Zebra 6.4.0 before 6.4.2 parses version 6 transactions carrying a pre-NU6.3 consensus branch ID, but the size computation during UnminedTx construction treats re-serialization of the Orchard bundle as infallible, so the resulting error trips an expect that aborts zebrad. Unauthenticated peers can send a single pre-handshake tx message to crash the node, and can repeat this after each restart.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Zcashfoundation Zfnd
Products
Zebra Zebra
CVE-2026-104437

Zebra before 4.4.0 Consensus Split via SIGHASH_SINGLE Missing-Output Handling

Zebra before 4.4.0 contains a consensus divergence vulnerability in V5 transparent signature verification, computing a ZIP-244 digest for SIGHASH_SINGLE inputs lacking corresponding outputs instead of failing. Attackers can craft V5 transactions with fewer outputs than inputs that Zebra accepts and templates via getblocktemplate, producing blocks zcashd rejects.

CVSS 4.0 · 8.3 High EPSS < 1% KEV · Not listed
Vendors
Zcashfoundation Zfnd
Products
Zebra Zebra
CVE-2026-104432

Zebra before 6.3.0 False Readiness via Discarded One-Hash FindBlocks Response

Zebra before 6.3.0 contains an improper exceptional condition check in ChainSync::obtain_tips that discards valid one-hash FindBlocks responses, falsely reporting close-to-tip status. Peers returning only the next block hash cause a zero-length sync sample, making the /ready endpoint return 200 OK while the node remains behind the tip.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Zcashfoundation Zfnd
Products
Zebra Zebra
CVE-2026-104428

Zebra before 11.0.0 Denial of Service via getblock Verbosity 2

The getblock RPC method in zebra-rpc before 11.0.0, used by the Zcash Foundation's Zebra node, panics on verbosity 2 for a side-chain block because the block's -1 confirmations sentinel is converted to u32 with .expect(), aborting the process. Remote unauthenticated attackers, directly or through lightwalletd, can repeat this call to keep the node in a crash loop.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Zcashfoundation Zfnd
Products
Zebra Zebra
CVE-2026-104424

Zebra before 6.1.0 Incorrect Block Size Calculation in getblocktemplate

Zebra before 6.1.0 contains an incorrect calculation vulnerability in its ZIP-317 block template selector that omits header and transaction-count size from the block budget. Attackers can place valid selectable transactions in a victim miner's mempool to shape templates into oversized blocks, causing rejection and wasted proof-of-work.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Zcashfoundation Zfnd
Products
Zebra Zebra
CVE-2026-104420

Zebra before 6.3.0 Peer Misbehavior Ban Bypass via Gossiped Blocks

Zebra before 6.3.0 contains a protection mechanism failure that allows unauthenticated peers to evade misbehavior scoring by supplying invalid gossiped blocks. The inbound cleanup step wrongly downcasts RouterError to VerifyBlockError and discards the score, so attackers can repeatedly force block download and Equihash verification without being banned.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Zcashfoundation Zfnd
Products
Zebra Zebra
CVE-2026-104419

Zebra before 6.3.0 Honest Peer Banning via Far-Ahead FindBlocks Hashes

Zebra (zebrad) 4.5.0 before 6.3.0 discards which peer supplied the block hashes in FindBlocks responses, then assigns 100 misbehavior points, the ban threshold, to whichever peer serves a requested block more than 50,000 heights above the tip. A remote peer can return real far-ahead hashes to a syncing node so that honest peers get banned, eroding its peer set and raising eclipse risk.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Zcashfoundation Zfnd
Products
Zebra Zebra
CVE-2026-104427

Zebra before 6.1.0 Chain Stall via Stale parent_error_map Entry

Zebra before 6.1.0 contains an incomplete cleanup vulnerability in the state write task that allows remote unauthenticated peers to stall node synchronization by poisoning parent_error_map. Attackers can deliver a coinbase-malleated block sharing a canonical block's hash before it propagates, causing the next canonical block to be rejected and stalling the node for roughly 2,000 blocks.

CVSS 4.0 · 8.2 High EPSS < 1% KEV · Not listed
Vendors
Zcashfoundation Zfnd
Products
Zebra Zebra
CVE-2026-104422

Zebra before 6.3.0 Block Sync Denial of Service via Coinbase scriptSig Rewrite

The block sync download path in Zebra (zebrad) before 6.3.0 reads a block's height from its unvalidated coinbase scriptSig and drops blocks that appear too far behind the tip before consensus validation, without penalizing the supplying peer. Because V5 transaction IDs exclude the scriptSig, a malicious peer can repeatedly serve a canonical block whose coinbase claims height 1 while keeping the requested hash, delaying the node's discovery of the newest block.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Zcashfoundation Zfnd
Products
Zebra Zebra