Skip to main content
cve.nowby Sazabi
← crates.io
crates.ioPackage

zebrad

26 known vulnerabilities (7 critical, 8 high, 11 medium), with the versions each affects and the releases that fix them.

Latest release
7.0.0 (Oct 22, 2026): no advisory affects it
Newest unaffected release
7.0.0 (Oct 22, 2026), the latest release
Advisories
26 · 7 critical, 8 high, 11 medium
Weekly downloads
56
Dependents
0
Releases
52 since 1.0.0 (Jun 14, 2023)
Registry
crates.io
Releases read
Nov 8, 2026

Version timeline

  • CVE-2026-104437
    Affects 0.0.0-placeholder.0 to 4.3.1 (4.4.0 is outside it)
  • CVE-2026-104436
    Affects 0.0.0-placeholder.0 to 4.4.1 (4.5.0 is outside it)
  • CVE-2026-104435
    Affects 0.0.0-placeholder.0 to 4.4.0 (4.4.1 is outside it)
  • CVE-2026-104434
    Affects 0.0.0-placeholder.0 to 4.4.1 (4.5.0 is outside it)
  • CVE-2026-52829
    Affects 0.0.0-placeholder.0 to 4.4.1 (4.5.0 is outside it)
  • CVE-2026-52736
    Affects 0.0.0-placeholder.0 to 4.4.1 (4.5.0 is outside it)
  • CVE-2026-52732
    Affects 0.0.0-placeholder.0 to 4.4.1 (4.5.0 is outside it)
  • CVE-2026-52731
    Affects 0.0.0-placeholder.0 to 4.4.1 (4.5.0 is outside it)
  • CVE-2026-52733
    Affects 0.0.0-placeholder.0 to 4.4.1 (4.5.0 is outside it)
  • CVE-2026-52738
    Affects 0.0.0-placeholder.0 to 4.4.1 (4.5.0 is outside it)
  • CVE-2026-52735
    Affects 0.0.0-placeholder.0 to 4.4.1 (4.5.0 is outside it)
  • CVE-2026-52739
    Affects 0.0.0-placeholder.0 to 4.4.1 (4.5.0 is outside it)
Show all 26 advisoriesShow fewer advisories
  • CVE-2026-52734
    Affects 0.0.0-placeholder.0 to 4.4.1 (4.5.0 is outside it)
  • CVE-2026-52737
    Affects 0.0.0-placeholder.0 to 4.4.1 (4.5.0 is outside it)
  • CVE-2026-54496
    Affects 0.0.0-placeholder.0 to 4.5.1 (5.0.0 is outside it)
  • CVE-2026-44499
    Affects 0.0.0-placeholder.0 to 4.3.1 (4.4.0 is outside it)
  • CVE-2026-44500
    Affects 0.0.0-placeholder.0 to 4.3.1 (4.4.0 is outside it)
  • CVE-2026-44498
    Affects 0.0.0-placeholder.0 to 4.3.1 (4.4.0 is outside it)
  • CVE-2026-44497
    Affects 0.0.0-placeholder.0 to 4.3.1 (4.4.0 is outside it)
  • CVE-2026-41585
    Affects 2.2.0 to 4.3.0 (4.3.1 is outside it)
  • CVE-2026-41584
    Affects 0.0.0-placeholder.0 to 4.3.0 (4.3.1 is outside it)
  • CVE-2026-41583
    Affects 0.0.0-placeholder.0 to 4.3.0 (4.3.1 is outside it)
  • CVE-2026-40881
    Affects 0.0.0-placeholder.0 to 4.3.0 (4.3.1 is outside it)
  • CVE-2026-40880
    Affects 0.0.0-placeholder.0 to 4.3.0 (4.3.1 is outside it)
  • CVE-2026-34377
    Affects 0.0.0-placeholder.0 to 4.2.0 (4.3.0 is outside it)
  • CVE-2026-34202
    Affects 0.0.0-placeholder.0 to 4.2.0 (4.3.0 is outside it)
Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 26

  • Zebra before 4.4.0 Consensus Split via SIGHASH_SINGLE Missing-Output Handling

    Affected: fixed in 4.4.0.

    Fixed in 4.4.0 (released May 1, 2026, 154 days before disclosure).

    The latest release, 7.0.0, is not affected.

  • CVE-2026-104436Medium 6.3

    Zebra before 4.5.0 CPU Amplification via Uncapped getblocks/getheaders Locator Length

    Affected: fixed in 4.5.0.

    Fixed in 4.5.0 (released May 29, 2026, 126 days before disclosure).

    The latest release, 7.0.0, is not affected.

  • Zebra 4.4.0 Consensus Divergence via V5 SIGHASH_SINGLE Without Output

    Affected: fixed in 4.4.1.

    Fixed in 4.4.1 (released May 4, 2026, 151 days before disclosure).

    The latest release, 7.0.0, is not affected.

  • Zebra before 8.0.0 Denial of Service via z_listunifiedreceivers RPC

    Affected: fixed in 4.5.0.

    Fixed in 4.5.0 (released May 29, 2026, 126 days before disclosure).

    The latest release, 7.0.0, is not affected.

  • ZEBRA: IPv4-Mapped Mempool Misbehavior Update Aborts Zebra Address Book

    Affected: fixed in 4.5.0.

    Fixed in 4.5.0 (released May 29, 2026, 81 days before disclosure).

    The latest release, 7.0.0, is not affected.

  • ZEBRA: Block suppression via NU5 same-header body poisoning of sent-hash cache

    Affected: fixed in 4.5.0.

    Fixed in 4.5.0 (released May 29, 2026, 81 days before disclosure).

    The latest release, 7.0.0, is not affected.

  • CVE-2026-52732Medium 5.3

    ZEBRA: Mempool transaction admission denial via single-peer inbound queue saturation

    Affected: fixed in 4.5.0.

    Fixed in 4.5.0 (released May 29, 2026, 81 days before disclosure).

    The latest release, 7.0.0, is not affected.

  • CVE-2026-52731Medium 6.5

    ZEBRA: Full node denial of service via non-ASCII LongPollId in getblocktemplate

    Affected: fixed in 4.5.0.

    Fixed in 4.5.0 (released May 29, 2026, 81 days before disclosure).

    The latest release, 7.0.0, is not affected.

  • CVE-2026-52733Medium 6.5

    ZEBRA: Persistent on-disk corruption of Sapling/Orchard subtree roots after chain fork via pop_tip

    Affected: fixed in 4.5.0.

    Fixed in 4.5.0 (released May 29, 2026, 81 days before disclosure).

    The latest release, 7.0.0, is not affected.

  • CVE-2026-52738Medium 6.9

    ZEBRA: Finalized address balance credit-first overflow on consensus-valid blocks

    Affected: fixed in 4.5.0.

    Fixed in 4.5.0 (released May 29, 2026, 81 days before disclosure).

    The latest release, 7.0.0, is not affected.

  • CVE-2026-52735Critical 9.3

    ZEBRA: Consensus divergence via P2SH sigop undercount in pure-Rust disabled-opcode parser

    Affected: fixed in 4.5.0.

    Fixed in 4.5.0 (released May 29, 2026, 81 days before disclosure).

    The latest release, 7.0.0, is not affected.

  • CVE-2026-52739Medium 5.9

    ZEBRA: Repeated Non-Finalized Shielded Transaction Aborts Zebra Before Duplicate-Nullifier Rejection

    Affected: fixed in 4.5.0.

    Fixed in 4.5.0 (released May 29, 2026, 81 days before disclosure).

    The latest release, 7.0.0, is not affected.

  • CVE-2026-52734Medium 5.3

    ZEBRA: Unbounded memory leak in mempool download pipeline via timeout path cancel_handles retention

    Affected: fixed in 4.5.0.

    Fixed in 4.5.0 (released May 29, 2026, 81 days before disclosure).

    The latest release, 7.0.0, is not affected.

  • CVE-2026-52737Medium 5.3

    ZEBRA: Sync restart poisoning from single unauthenticated peer via above-lookahead block

    Affected: fixed in 4.5.0.

    Fixed in 4.5.0 (released May 29, 2026, 81 days before disclosure).

    The latest release, 7.0.0, is not affected.

  • CVE-2026-54496Critical 9.3

    Missing copy constraint in halo2_gadgets variable-base scalar multiplication allows under-constrained base, breaking Orchard Action…

    Affected: fixed in 5.0.0.

    Fixed in 5.0.0 (released Jun 3, 2026, 44 days before disclosure).

    The latest release, 7.0.0, is not affected.

Show all 26 advisoriesShow fewer advisories

  • ZEBRA: Permanent Block Discovery Halt via Gossip Queue Saturation and Syncer Poisoning

    Affected: fixed in 4.4.0.

    Fixed in 4.4.0 (released May 1, 2026, 7 days before disclosure).

    The latest release, 7.0.0, is not affected.

  • CVE-2026-44500Medium 5.3

    ZEBRA: Allocation Amplification in Inbound Network Deserializers

    Affected: fixed in 4.4.0.

    Fixed in 4.4.0 (released May 1, 2026, 7 days before disclosure).

    The latest release, 7.0.0, is not affected.

  • CVE-2026-44498Critical 9.2

    ZEBRA: Block Validator Undercounts Coinbase and P2SH Sigops

    Affected: fixed in 4.4.0.

    Fixed in 4.4.0 (released May 1, 2026, 7 days before disclosure).

    The latest release, 7.0.0, is not affected.

  • CVE-2026-44497Critical 9.3

    ZEBRA: Consensus Divergence in Transparent Sighash Hash-Type Handling due to Stale Buffer

    Affected: fixed in 4.4.0.

    Fixed in 4.4.0 (released May 1, 2026, 7 days before disclosure).

    The latest release, 7.0.0, is not affected.

  • CVE-2026-41585Medium 6.9

    ZEBRA: Denial of Service via Interrupted JSON-RPC Requests from Authenticated Clients

    Affected: from 2.2.0, fixed in 4.3.1.

    Fixed in 4.3.1 (released Apr 17, 2026, 21 days before disclosure).

    The latest release, 7.0.0, is not affected.

  • CVE-2026-41584Critical 9.2

    ZEBRA: rk Identity Point Panic in Transaction Verification

    Affected: fixed in 4.3.1.

    Fixed in 4.3.1 (released Apr 17, 2026, 21 days before disclosure).

    The latest release, 7.0.0, is not affected.

  • CVE-2026-41583Critical 9.3

    ZEBRA: Consensus Divergence in Transparent Sighash Hash-Type Handling

    Affected: fixed in 4.3.1.

    Fixed in 4.3.1 (released Apr 17, 2026, 21 days before disclosure).

    The latest release, 7.0.0, is not affected.

  • CVE-2026-40881Medium 6.3

    Zebra: addr/addrv2 Deserialization Resource Exhaustion

    Affected: fixed in 4.3.1.

    Fixed in 4.3.1 (released Apr 17, 2026, 4 days before disclosure).

    The latest release, 7.0.0, is not affected.

  • Zebra: Cached Mempool Verification Bypasses Consensus Rules for Ahead-of-Tip Blocks

    Affected: fixed in 4.3.1.

    Fixed in 4.3.1 (released Apr 17, 2026, 4 days before disclosure).

    The latest release, 7.0.0, is not affected.

  • Zebra has a Consensus Failure due to Improper Verification of V5 Transactions

    Affected: fixed in 4.3.0.

    Fixed in 4.3.0 (released Mar 25, 2026, 6 days before disclosure).

    The latest release, 7.0.0, is not affected.

  • CVE-2026-34202Critical 9.2

    Zebra node crash — V5 transaction hash panic (P2P reachable)

    Affected: fixed in 4.3.0.

    Fixed in 4.3.0 (released Mar 25, 2026, 6 days before disclosure).

    The latest release, 7.0.0, is not affected.