CVE-2026-40881
High · 7.5CVSS
7.5
EPSS
0.5%
Published
Apr 21, 2026
CISA due date
—
The record
ZEBRA is a Zcash node written entirely in Rust. Prior to zebrad version 4.3.0 and zebra-network version 5.0.1, when deserializing addr or addrv2 messages, which contain vectors of addresses, Zebra would fully deserialize them up to a maximum length (over 233,000) that was derived from the 2 MiB message size limit. This is much larger than the actual limit of 1,000 messages from the specification. Zebra would eventually check that limit but, at that point, the memory for the larger vector was already allocated. An attacker could cause out-of-memory aborts in Zebra by sending multiple such messages over different connections. This vulnerability is fixed in zebrad version 4.3.0 and zebra-network version 5.0.1.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| crates.io | zebra-network | 0 | 5.0.1 |
| crates.io | zebrad | 0 | 4.3.1 |
Related vulnerabilities
- GHSA-xr93-pcq3-pxf8 Zebra: addr/addrv2 Deserialization Resource Exhaustion Same vulnerability
- CVE-2026-44500 ZEBRA is a Zcash node written entirely in Rust. Also affects zebra-network
- GHSA-438q-jx8f-cccv Zebra Vulnerable to Allocation Amplification in Inbound Network Deserializers Also affects zebra-network
- GHSA-h9hm-m2xj-4rq9 Zebra has Permanent Block Discovery Halt via Gossip Queue Saturation and Syncer Poisoning Also affects zebrad
- GHSA-pvmv-cwg8-v6c8 Zebra v4.4.0 still accepts V5 SIGHASH_SINGLE without a corresponding output Also affects zebrad
- CVE-2026-44499 ZEBRA is a Zcash node written entirely in Rust. Also affects zebrad
- CVE-2026-44497 ZEBRA is a Zcash node written entirely in Rust. Also affects zebrad
- CVE-2026-44498 ZEBRA is a Zcash node written entirely in Rust. Also affects zebrad