What’s Vulnerable › Products

ZcashFoundation zebra vulnerabilities

42 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 42 published in the last 12 months.

Check whether your ZcashFoundation zebra version is affected

Latest ZcashFoundation zebra vulnerabilities

• CVE-2026-109366 — Zebra before 6.4.0 Gossiped Block Drop via Forged Coinbase scriptSig Height (CVSS 3.7)
• CVE-2026-109365 — Zebra before 6.4.0 Denial of Service via Same-Hash Forged Block Bodies (CVSS 3.7)
• CVE-2026-109364 — Zebra 2.3.0 before 6.4.0 Peer Ban Bypass via Exact-IP Keying (CVSS 5.3)
• CVE-2026-109363 — Zebra 6.4.0 before 6.4.2 Denial of Service via Malformed v6 Transaction (CVSS 7.5)
• CVE-2026-104437 — Zebra before 4.4.0 Consensus Split via SIGHASH_SINGLE Missing-Output Handling (CVSS 7.4)
• CVE-2026-104435 — Zebra 4.4.0 Consensus Divergence via V5 SIGHASH_SINGLE Without Output (CVSS 7.4)
• CVE-2026-104434 — Zebra before 8.0.0 Denial of Service via z_listunifiedreceivers RPC (CVSS 6.5)
• CVE-2026-104432 — Zebra before 6.3.0 False Readiness via Discarded One-Hash FindBlocks Response (CVSS 5.3)
• CVE-2026-104431 — Zebra before 6.0.0 Denial of Service via Synchronous Script FFI Verification (CVSS 7.5)
• CVE-2026-104430 — Zebra 4.5.0 Consensus Split via P2SH Sigop Overcount (CVSS 7.5)
• CVE-2026-104429 — Zebra before 6.0.0-rc.0 Per-Peer Mempool Admission Bypass via P2P tx Messages (CVSS 5.3)
• CVE-2026-104428 — Zebra before 11.0.0 Denial of Service via getblock Verbosity 2 (CVSS 5.3)
• CVE-2026-104427 — Zebra before 6.1.0 Chain Stall via Stale parent_error_map Entry (CVSS 5.9)
• CVE-2026-104426 — Zebra before 6.1.0 Quadratic Complexity DoS via Block Transparent Value Check (CVSS 5.9)
• CVE-2026-104425 — Zebra before 6.1.0 Batch-Verification Poisoning DoS via Unattributed Pushed Transactions (CVSS 5.3)
• CVE-2026-104424 — Zebra before 6.1.0 Incorrect Block Size Calculation in getblocktemplate (CVSS 3.7)
• CVE-2026-104423 — Zebra before 6.2.1 Denial of Service via Uncapped V6 Shielded Proof Verification (CVSS 7.5)
• CVE-2026-104422 — Zebra before 6.3.0 Block Sync Denial of Service via Coinbase scriptSig Rewrite (CVSS 7.5)
• CVE-2026-104421 — Zebra before 6.2.1 Block Download Denial of Service via KnownBlock SentHashes Lockout (CVSS 5.3)
• CVE-2026-104420 — Zebra before 6.3.0 Peer Misbehavior Ban Bypass via Gossiped Blocks (CVSS 5.3)
• CVE-2026-104419 — Zebra before 6.3.0 Honest Peer Banning via Far-Ahead FindBlocks Hashes (CVSS 4.8)
• CVE-2026-104436 — Zebra before 4.5.0 CPU Amplification via Uncapped getblocks/getheaders Locator Length (CVSS 3.7)
• CVE-2026-52829 — ZEBRA: IPv4-Mapped Mempool Misbehavior Update Aborts Zebra Address Book (CVSS 7.5)
• CVE-2026-52739 — ZEBRA: Repeated Non-Finalized Shielded Transaction Aborts Zebra Before Duplicate-Nullifier Rejection (CVSS 5.9)
• CVE-2026-52738 — ZEBRA: Finalized address balance credit-first overflow on consensus-valid blocks (CVSS 6.9)