GCVE - cpe:2.3:a:zfnd:zebra-chain:*:*:*:*:*:rust:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:zfnd:zebra-chain:*:*:*:*:*:rust:*:*

part: a version: * update: *

Vendor	Zfnd (`86acb11b-50a5-5ca1-a20b-124d696a668f`)
Product	Zebra Chain (`d573fb0e-1ca9-5ace-bd30-7454606120ca`)
Edition	*
Language	*
Software edition	*
Target software	rust
Target hardware	*
Other	*
Notes	Imported from gcve-enriched-dumps CVE data

PURL mappings

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2026-44500`	vulnerable	2026-06-08 08:05:11.116110	ZEBRA: Allocation Amplification in Inbound Network Deserializers MEDIUM (5.3) ZEBRA is a Zcash node written entirely in Rust. Prior to zebrad version 4.4.0, prior to zebra-chain version 7.0.0, and prior to zebra-network version 6.0.0, several inbound deserialization paths in Zebra allocated buffers sized against generic transport or block-size ceilings before the tighter protocol or consensus limits were enforced. An unauthenticated or post-handshake peer could therefore force the node to preallocate and parse for orders of magnitude more data than the protocol intended, across headers messages, equihash solutions in block headers, Sapling spend vectors in V5/V4 transactions, and coinbase script bytes in blocks. This issue has been patched in zebrad version 4.4.0, zebra-chain version 7.0.0, and zebra-network version 6.0.0. Published: 2026-05-08T15:10:21.516Z Updated: 2026-05-08T19:41:46.471Z Open on db.gcve.eu Reference links https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-438q-jx8f-cccv	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2026-41584`	vulnerable	2026-06-08 08:03:15.591460	ZEBRA: rk Identity Point Panic in Transaction Verification ZEBRA is a Zcash node written entirely in Rust. Prior to zebrad version 4.3.1 and prior to zebra-chain version 6.0.2, Orchard transactions contain a rk field which is a randomized validating key and also an elliptic curve point. The Zcash specification allows the field to be the identity (a "zero" value), however, the orchard crate which is used to verify Orchard proofs would panic when fed a rk with the identity value. Thus an attacker could send a crafted transaction that would make a Zebra node crash. This issue has been patched in zebrad version 4.3.1 and zebra-chain version 6.0.2. Published: 2026-05-08T15:05:06.070Z Updated: 2026-05-08T16:04:49.931Z Open on db.gcve.eu Reference links https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-452v-w3gx-72wg	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2026-34202`	vulnerable	2026-06-08 07:59:11.881117	Zebra node crash — V5 transaction hash panic (P2P reachable) ZEBRA is a Zcash node written entirely in Rust. Prior to zebrad version 4.3.0 and zebra-chain version 6.0.1, a vulnerability in Zebra's transaction processing logic allows a remote, unauthenticated attacker to cause a Zebra node to panic (crash). This is triggered by sending a specially crafted V5 transaction that passes initial deserialization but fails during transaction ID calculation. This issue has been patched in zebrad version 4.3.0 and zebra-chain version 6.0.1. Published: 2026-03-31T14:02:56.454Z Updated: 2026-03-31T17:17:30.860Z Open on db.gcve.eu Reference links https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-qp6f-w4r3-h8wg https://github.com/ZcashFoundation/zebra/releases/tag/v4.3.0 https://zfnd.org/zebra-4-3-0-critical-security-fixes-zip-235-support-and-performance-improvements	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.