# zebrad (crates.io) vulnerabilities 26 known vulnerabilities (7 critical, 8 high, 11 medium), with the versions each affects and the releases that fix them. ## At a glance - Latest release: 7.0.0 (Oct 22, 2026): no advisory affects it - Newest unaffected release: 7.0.0 (Oct 22, 2026), the latest release - Weekly downloads: 56 - Dependents: 0 - Releases: 52 since 1.0.0 (Jun 14, 2023) - Registry: https://crates.io/crates/zebrad - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-104437: 0.0.0-placeholder.0 to 4.3.1 (4.4.0 is outside it) - CVE-2026-104436: 0.0.0-placeholder.0 to 4.4.1 (4.5.0 is outside it) - CVE-2026-104435: 0.0.0-placeholder.0 to 4.4.0 (4.4.1 is outside it) - CVE-2026-104434: 0.0.0-placeholder.0 to 4.4.1 (4.5.0 is outside it) - CVE-2026-52829: 0.0.0-placeholder.0 to 4.4.1 (4.5.0 is outside it) - CVE-2026-52736: 0.0.0-placeholder.0 to 4.4.1 (4.5.0 is outside it) - CVE-2026-52732: 0.0.0-placeholder.0 to 4.4.1 (4.5.0 is outside it) - CVE-2026-52731: 0.0.0-placeholder.0 to 4.4.1 (4.5.0 is outside it) - CVE-2026-52733: 0.0.0-placeholder.0 to 4.4.1 (4.5.0 is outside it) - CVE-2026-52738: 0.0.0-placeholder.0 to 4.4.1 (4.5.0 is outside it) - CVE-2026-52735: 0.0.0-placeholder.0 to 4.4.1 (4.5.0 is outside it) - CVE-2026-52739: 0.0.0-placeholder.0 to 4.4.1 (4.5.0 is outside it) - CVE-2026-52734: 0.0.0-placeholder.0 to 4.4.1 (4.5.0 is outside it) - CVE-2026-52737: 0.0.0-placeholder.0 to 4.4.1 (4.5.0 is outside it) - CVE-2026-54496: 0.0.0-placeholder.0 to 4.5.1 (5.0.0 is outside it) - CVE-2026-44499: 0.0.0-placeholder.0 to 4.3.1 (4.4.0 is outside it) - CVE-2026-44500: 0.0.0-placeholder.0 to 4.3.1 (4.4.0 is outside it) - CVE-2026-44498: 0.0.0-placeholder.0 to 4.3.1 (4.4.0 is outside it) - CVE-2026-44497: 0.0.0-placeholder.0 to 4.3.1 (4.4.0 is outside it) - CVE-2026-41585: 2.2.0 to 4.3.0 (4.3.1 is outside it) - CVE-2026-41584: 0.0.0-placeholder.0 to 4.3.0 (4.3.1 is outside it) - CVE-2026-41583: 0.0.0-placeholder.0 to 4.3.0 (4.3.1 is outside it) - CVE-2026-40881: 0.0.0-placeholder.0 to 4.3.0 (4.3.1 is outside it) - CVE-2026-40880: 0.0.0-placeholder.0 to 4.3.0 (4.3.1 is outside it) - CVE-2026-34377: 0.0.0-placeholder.0 to 4.2.0 (4.3.0 is outside it) - CVE-2026-34202: 0.0.0-placeholder.0 to 4.2.0 (4.3.0 is outside it) ## Advisories (26) ### [CVE-2026-104437](https://cve.now/CVE-2026-104437): Zebra before 4.4.0 Consensus Split via SIGHASH\_SINGLE Missing-Output Handling - Severity: High 8.3 - Published: Oct 2, 2026 - Affected: fixed in 4.4.0. - Fixed in 4.4.0 (released May 1, 2026, 154 days before disclosure). - The latest release, 7.0.0, is not affected. ### [CVE-2026-104436](https://cve.now/CVE-2026-104436): Zebra before 4.5.0 CPU Amplification via Uncapped getblocks/getheaders Locator Length - Severity: Medium 6.3 - Published: Oct 2, 2026 - Affected: fixed in 4.5.0. - Fixed in 4.5.0 (released May 29, 2026, 126 days before disclosure). - The latest release, 7.0.0, is not affected. ### [CVE-2026-104435](https://cve.now/CVE-2026-104435): Zebra 4.4.0 Consensus Divergence via V5 SIGHASH\_SINGLE Without Output - Severity: High 8.3 - Published: Oct 2, 2026 - Affected: fixed in 4.4.1. - Fixed in 4.4.1 (released May 4, 2026, 151 days before disclosure). - The latest release, 7.0.0, is not affected. ### [CVE-2026-104434](https://cve.now/CVE-2026-104434): Zebra before 8.0.0 Denial of Service via z\_listunifiedreceivers RPC - Severity: High 7.1 - Published: Oct 2, 2026 - Affected: fixed in 4.5.0. - Fixed in 4.5.0 (released May 29, 2026, 126 days before disclosure). - The latest release, 7.0.0, is not affected. ### [CVE-2026-52829](https://cve.now/CVE-2026-52829): ZEBRA: IPv4-Mapped Mempool Misbehavior Update Aborts Zebra Address Book - Severity: High 7.5 - Published: Aug 18, 2026 - Affected: fixed in 4.5.0. - Fixed in 4.5.0 (released May 29, 2026, 81 days before disclosure). - The latest release, 7.0.0, is not affected. ### [CVE-2026-52736](https://cve.now/CVE-2026-52736): ZEBRA: Block suppression via NU5 same-header body poisoning of sent-hash cache - Severity: High 8.7 - Published: Aug 18, 2026 - Affected: fixed in 4.5.0. - Fixed in 4.5.0 (released May 29, 2026, 81 days before disclosure). - The latest release, 7.0.0, is not affected. ### [CVE-2026-52732](https://cve.now/CVE-2026-52732): ZEBRA: Mempool transaction admission denial via single-peer inbound queue saturation - Severity: Medium 5.3 - Published: Aug 18, 2026 - Affected: fixed in 4.5.0. - Fixed in 4.5.0 (released May 29, 2026, 81 days before disclosure). - The latest release, 7.0.0, is not affected. ### [CVE-2026-52731](https://cve.now/CVE-2026-52731): ZEBRA: Full node denial of service via non-ASCII LongPollId in getblocktemplate - Severity: Medium 6.5 - Published: Aug 18, 2026 - Affected: fixed in 4.5.0. - Fixed in 4.5.0 (released May 29, 2026, 81 days before disclosure). - The latest release, 7.0.0, is not affected. ### [CVE-2026-52733](https://cve.now/CVE-2026-52733): ZEBRA: Persistent on-disk corruption of Sapling/Orchard subtree roots after chain fork via pop\_tip - Severity: Medium 6.5 - Published: Aug 18, 2026 - Affected: fixed in 4.5.0. - Fixed in 4.5.0 (released May 29, 2026, 81 days before disclosure). - The latest release, 7.0.0, is not affected. ### [CVE-2026-52738](https://cve.now/CVE-2026-52738): ZEBRA: Finalized address balance credit-first overflow on consensus-valid blocks - Severity: Medium 6.9 - Published: Aug 18, 2026 - Affected: fixed in 4.5.0. - Fixed in 4.5.0 (released May 29, 2026, 81 days before disclosure). - The latest release, 7.0.0, is not affected. ### [CVE-2026-52735](https://cve.now/CVE-2026-52735): ZEBRA: Consensus divergence via P2SH sigop undercount in pure-Rust disabled-opcode parser - Severity: Critical 9.3 - Published: Aug 18, 2026 - Affected: fixed in 4.5.0. - Fixed in 4.5.0 (released May 29, 2026, 81 days before disclosure). - The latest release, 7.0.0, is not affected. ### [CVE-2026-52739](https://cve.now/CVE-2026-52739): ZEBRA: Repeated Non-Finalized Shielded Transaction Aborts Zebra Before Duplicate-Nullifier Rejection - Severity: Medium 5.9 - Published: Aug 18, 2026 - Affected: fixed in 4.5.0. - Fixed in 4.5.0 (released May 29, 2026, 81 days before disclosure). - The latest release, 7.0.0, is not affected. ### [CVE-2026-52734](https://cve.now/CVE-2026-52734): ZEBRA: Unbounded memory leak in mempool download pipeline via timeout path cancel\_handles retention - Severity: Medium 5.3 - Published: Aug 18, 2026 - Affected: fixed in 4.5.0. - Fixed in 4.5.0 (released May 29, 2026, 81 days before disclosure). - The latest release, 7.0.0, is not affected. ### [CVE-2026-52737](https://cve.now/CVE-2026-52737): ZEBRA: Sync restart poisoning from single unauthenticated peer via above-lookahead block - Severity: Medium 5.3 - Published: Aug 18, 2026 - Affected: fixed in 4.5.0. - Fixed in 4.5.0 (released May 29, 2026, 81 days before disclosure). - The latest release, 7.0.0, is not affected. ### [CVE-2026-54496](https://cve.now/CVE-2026-54496): Missing copy constraint in halo2\_gadgets variable-base scalar multiplication allows under-constrained base, breaking Orchard Action… - Severity: Critical 9.3 - Published: Jul 17, 2026 - Affected: fixed in 5.0.0. - Fixed in 5.0.0 (released Jun 3, 2026, 44 days before disclosure). - The latest release, 7.0.0, is not affected. ### [CVE-2026-44499](https://cve.now/CVE-2026-44499): ZEBRA: Permanent Block Discovery Halt via Gossip Queue Saturation and Syncer Poisoning - Severity: High 8.7 - Published: May 8, 2026 - Affected: fixed in 4.4.0. - Fixed in 4.4.0 (released May 1, 2026, 7 days before disclosure). - The latest release, 7.0.0, is not affected. ### [CVE-2026-44500](https://cve.now/CVE-2026-44500): ZEBRA: Allocation Amplification in Inbound Network Deserializers - Severity: Medium 5.3 - Published: May 8, 2026 - Affected: fixed in 4.4.0. - Fixed in 4.4.0 (released May 1, 2026, 7 days before disclosure). - The latest release, 7.0.0, is not affected. ### [CVE-2026-44498](https://cve.now/CVE-2026-44498): ZEBRA: Block Validator Undercounts Coinbase and P2SH Sigops - Severity: Critical 9.2 - Published: May 8, 2026 - Affected: fixed in 4.4.0. - Fixed in 4.4.0 (released May 1, 2026, 7 days before disclosure). - The latest release, 7.0.0, is not affected. ### [CVE-2026-44497](https://cve.now/CVE-2026-44497): ZEBRA: Consensus Divergence in Transparent Sighash Hash-Type Handling due to Stale Buffer - Severity: Critical 9.3 - Published: May 8, 2026 - Affected: fixed in 4.4.0. - Fixed in 4.4.0 (released May 1, 2026, 7 days before disclosure). - The latest release, 7.0.0, is not affected. ### [CVE-2026-41585](https://cve.now/CVE-2026-41585): ZEBRA: Denial of Service via Interrupted JSON-RPC Requests from Authenticated Clients - Severity: Medium 6.9 - Published: May 8, 2026 - Affected: from 2.2.0, fixed in 4.3.1. - Fixed in 4.3.1 (released Apr 17, 2026, 21 days before disclosure). - The latest release, 7.0.0, is not affected. ### [CVE-2026-41584](https://cve.now/CVE-2026-41584): ZEBRA: rk Identity Point Panic in Transaction Verification - Severity: Critical 9.2 - Published: May 8, 2026 - Affected: fixed in 4.3.1. - Fixed in 4.3.1 (released Apr 17, 2026, 21 days before disclosure). - The latest release, 7.0.0, is not affected. ### [CVE-2026-41583](https://cve.now/CVE-2026-41583): ZEBRA: Consensus Divergence in Transparent Sighash Hash-Type Handling - Severity: Critical 9.3 - Published: May 8, 2026 - Affected: fixed in 4.3.1. - Fixed in 4.3.1 (released Apr 17, 2026, 21 days before disclosure). - The latest release, 7.0.0, is not affected. ### [CVE-2026-40881](https://cve.now/CVE-2026-40881): Zebra: addr/addrv2 Deserialization Resource Exhaustion - Severity: Medium 6.3 - Published: Apr 21, 2026 - Affected: fixed in 4.3.1. - Fixed in 4.3.1 (released Apr 17, 2026, 4 days before disclosure). - The latest release, 7.0.0, is not affected. ### [CVE-2026-40880](https://cve.now/CVE-2026-40880): Zebra: Cached Mempool Verification Bypasses Consensus Rules for Ahead-of-Tip Blocks - Severity: High 7.2 - Published: Apr 21, 2026 - Affected: fixed in 4.3.1. - Fixed in 4.3.1 (released Apr 17, 2026, 4 days before disclosure). - The latest release, 7.0.0, is not affected. ### [CVE-2026-34377](https://cve.now/CVE-2026-34377): Zebra has a Consensus Failure due to Improper Verification of V5 Transactions - Severity: High 8.4 - Published: Mar 31, 2026 - Affected: fixed in 4.3.0. - Fixed in 4.3.0 (released Mar 25, 2026, 6 days before disclosure). - The latest release, 7.0.0, is not affected. ### [CVE-2026-34202](https://cve.now/CVE-2026-34202): Zebra node crash — V5 transaction hash panic (P2P reachable) - Severity: Critical 9.2 - Published: Mar 31, 2026 - Affected: fixed in 4.3.0. - Fixed in 4.3.0 (released Mar 25, 2026, 6 days before disclosure). - The latest release, 7.0.0, is not affected. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/crates.io/zebrad Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.