CVE-2026-41584
High · 7.5CVSS
7.5
EPSS
0.5%
Published
May 8, 2026
CISA due date
—
The record
ZEBRA is a Zcash node written entirely in Rust. Prior to zebrad version 4.3.1 and prior to zebra-chain version 6.0.2, Orchard transactions contain a rk field which is a randomized validating key and also an elliptic curve point. The Zcash specification allows the field to be the identity (a "zero" value), however, the orchard crate which is used to verify Orchard proofs would panic when fed a rk with the identity value. Thus an attacker could send a crafted transaction that would make a Zebra node crash. This issue has been patched in zebrad version 4.3.1 and zebra-chain version 6.0.2.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| crates.io | zebra-chain | 0 | 6.0.2 |
| crates.io | zebrad | 0 | 4.3.1 |
Related vulnerabilities
- GHSA-452v-w3gx-72wg Zebra has rk Identity Point Panic in Transaction Verification Same vulnerability
- CVE-2026-44500 ZEBRA is a Zcash node written entirely in Rust. Also affects zebra-chain
- GHSA-438q-jx8f-cccv Zebra Vulnerable to Allocation Amplification in Inbound Network Deserializers Also affects zebra-chain
- CVE-2026-34202 ZEBRA is a Zcash node written entirely in Rust. Also affects zebra-chain
- GHSA-qp6f-w4r3-h8wg Zebra node crash — V5 transaction hash panic (P2P reachable) Also affects zebra-chain
- GHSA-h9hm-m2xj-4rq9 Zebra has Permanent Block Discovery Halt via Gossip Queue Saturation and Syncer Poisoning Also affects zebrad
- GHSA-pvmv-cwg8-v6c8 Zebra v4.4.0 still accepts V5 SIGHASH_SINGLE without a corresponding output Also affects zebrad
- CVE-2026-44499 ZEBRA is a Zcash node written entirely in Rust. Also affects zebrad