crates.ioPackage

zebra-script

4 known vulnerabilities (3 critical, 1 high), with the versions each affects and the releases that fix them.

Version timeline

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

CVE-2026-104435High 8.3
Zebra 4.4.0 Consensus Divergence via V5 SIGHASH_SINGLE Without Output
Affected: fixed in 6.0.1.
Fixed in 6.0.1 (released May 4, 2026, 151 days before disclosure).
The latest release, 14.0.0, is not affected.
CVE-2026-52735Critical 9.3
ZEBRA: Consensus divergence via P2SH sigop undercount in pure-Rust disabled-opcode parser
Affected: fixed in 7.0.0.
Fixed in 7.0.0 (released May 29, 2026, 81 days before disclosure).
The latest release, 14.0.0, is not affected.
CVE-2026-44497Critical 9.3
ZEBRA: Consensus Divergence in Transparent Sighash Hash-Type Handling due to Stale Buffer
Affected: fixed in 6.0.0.
Fixed in 6.0.0 (released May 1, 2026, 7 days before disclosure).
The latest release, 14.0.0, is not affected.
CVE-2026-41583Critical 9.3
ZEBRA: Consensus Divergence in Transparent Sighash Hash-Type Handling
Affected: fixed in 5.0.2.
Fixed in 6.0.0 (released May 1, 2026, 7 days before disclosure, the advisory names 5.0.2, which was never published).
The latest release, 14.0.0, is not affected.