# cve.now: Zcashfoundation

The newest entries naming Zcashfoundation as an affected vendor (up to 200), of 52 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-123560](https://cve.now/CVE-2026-123560.md): Zebra before 7.0.0 Sync Denial of Service via Forged Checkpoint Block Body (CVSS 8.7)
- [CVE-2026-123559](https://cve.now/CVE-2026-123559.md): Zebra before 7.0.0 Denial of Service via Quadratic Sighash Computation (CVSS 8.7)
- [CVE-2026-123558](https://cve.now/CVE-2026-123558.md): Zebra before 7.0.0 Checkpoint Sync Denial of Service via Cancelled Verifier Rewind (CVSS 8.7)
- [CVE-2026-123557](https://cve.now/CVE-2026-123557.md): Zebra zebrad before 7.0.0 Reachable Assertion DoS via Peer Disconnection (CVSS 8.2)
- [CVE-2026-123556](https://cve.now/CVE-2026-123556.md): Zebra 4.5.0 before 7.0.0 Honest Peer Ban via Mempool Lock-Time Scoring (CVSS 6.9)
- [CVE-2026-123555](https://cve.now/CVE-2026-123555.md): Zebra 2.3.0 before 7.0.0 Denial of Service via Unscored Script Verification Failures (CVSS 8.7)
- [CVE-2026-123554](https://cve.now/CVE-2026-123554.md): Zebra zebrad 6.4.0 before 7.0.0 Denial of Service via Mempool Coinbase-Maturity Check (CVSS 8.7)
- [CVE-2026-109366](https://cve.now/CVE-2026-109366.md): Zebra before 6.4.0 Gossiped Block Drop via Forged Coinbase scriptSig Height (CVSS 6.3)
- [CVE-2026-109365](https://cve.now/CVE-2026-109365.md): Zebra before 6.4.0 Denial of Service via Same-Hash Forged Block Bodies (CVSS 6.3)
- [CVE-2026-109364](https://cve.now/CVE-2026-109364.md): Zebra 2.3.0 before 6.4.0 Peer Ban Bypass via Exact-IP Keying (CVSS 6.9)
- [CVE-2026-109363](https://cve.now/CVE-2026-109363.md): Zebra 6.4.0 before 6.4.2 Denial of Service via Malformed v6 Transaction (CVSS 8.7)
- [CVE-2026-104437](https://cve.now/CVE-2026-104437.md): Zebra before 4.4.0 Consensus Split via SIGHASH\_SINGLE Missing-Output Handling (CVSS 8.3)
- [CVE-2026-104436](https://cve.now/CVE-2026-104436.md): Zebra before 4.5.0 CPU Amplification via Uncapped getblocks/getheaders Locator Length (CVSS 6.3)
- [CVE-2026-104435](https://cve.now/CVE-2026-104435.md): Zebra 4.4.0 Consensus Divergence via V5 SIGHASH\_SINGLE Without Output (CVSS 8.3)
- [CVE-2026-104434](https://cve.now/CVE-2026-104434.md): Zebra before 8.0.0 Denial of Service via z\_listunifiedreceivers RPC (CVSS 7.1)
- [CVE-2026-104432](https://cve.now/CVE-2026-104432.md): Zebra before 6.3.0 False Readiness via Discarded One-Hash FindBlocks Response (CVSS 6.9)
- [CVE-2026-104431](https://cve.now/CVE-2026-104431.md): Zebra before 6.0.0 Denial of Service via Synchronous Script FFI Verification (CVSS 8.7)
- [CVE-2026-104430](https://cve.now/CVE-2026-104430.md): Zebra 4.5.0 Consensus Split via P2SH Sigop Overcount (CVSS 8.7)
- [CVE-2026-104429](https://cve.now/CVE-2026-104429.md): Zebra before 6.0.0-rc.0 Per-Peer Mempool Admission Bypass via P2P tx Messages (CVSS 6.9)
- [CVE-2026-104428](https://cve.now/CVE-2026-104428.md): Zebra before 11.0.0 Denial of Service via getblock Verbosity 2 (CVSS 6.9)
- [CVE-2026-104427](https://cve.now/CVE-2026-104427.md): Zebra before 6.1.0 Chain Stall via Stale parent\_error\_map Entry (CVSS 8.2)
- [CVE-2026-104426](https://cve.now/CVE-2026-104426.md): Zebra before 6.1.0 Quadratic Complexity DoS via Block Transparent Value Check (CVSS 8.2)
- [CVE-2026-104425](https://cve.now/CVE-2026-104425.md): Zebra before 6.1.0 Batch-Verification Poisoning DoS via Unattributed Pushed Transactions (CVSS 6.9)
- [CVE-2026-104424](https://cve.now/CVE-2026-104424.md): Zebra before 6.1.0 Incorrect Block Size Calculation in getblocktemplate (CVSS 6.3)
- [CVE-2026-104423](https://cve.now/CVE-2026-104423.md): Zebra before 6.2.1 Denial of Service via Uncapped V6 Shielded Proof Verification (CVSS 8.7)
- [CVE-2026-104422](https://cve.now/CVE-2026-104422.md): Zebra before 6.3.0 Block Sync Denial of Service via Coinbase scriptSig Rewrite (CVSS 8.7)
- [CVE-2026-104421](https://cve.now/CVE-2026-104421.md): Zebra before 6.2.1 Block Download Denial of Service via KnownBlock SentHashes Lockout (CVSS 6.9)
- [CVE-2026-104420](https://cve.now/CVE-2026-104420.md): Zebra before 6.3.0 Peer Misbehavior Ban Bypass via Gossiped Blocks (CVSS 6.9)
- [CVE-2026-104419](https://cve.now/CVE-2026-104419.md): Zebra before 6.3.0 Honest Peer Banning via Far-Ahead FindBlocks Hashes (CVSS 6.3)
- [CVE-2026-52829](https://cve.now/CVE-2026-52829.md): ZEBRA: IPv4-Mapped Mempool Misbehavior Update Aborts Zebra Address Book (CVSS 7.5)
- [CVE-2026-52736](https://cve.now/CVE-2026-52736.md): ZEBRA: Block suppression via NU5 same-header body poisoning of sent-hash cache (CVSS 8.7)
- [CVE-2026-52732](https://cve.now/CVE-2026-52732.md): ZEBRA: Mempool transaction admission denial via single-peer inbound queue saturation (CVSS 5.3)
- [CVE-2026-52731](https://cve.now/CVE-2026-52731.md): ZEBRA: Full node denial of service via non-ASCII LongPollId in getblocktemplate (CVSS 6.5)
- [CVE-2026-52733](https://cve.now/CVE-2026-52733.md): ZEBRA: Persistent on-disk corruption of Sapling/Orchard subtree roots after chain fork via pop\_tip (CVSS 6.5)
- [CVE-2026-52738](https://cve.now/CVE-2026-52738.md): ZEBRA: Finalized address balance credit-first overflow on consensus-valid blocks (CVSS 6.9)
- [CVE-2026-52735](https://cve.now/CVE-2026-52735.md): ZEBRA: Consensus divergence via P2SH sigop undercount in pure-Rust disabled-opcode parser (CVSS 9.3)
- [CVE-2026-52739](https://cve.now/CVE-2026-52739.md): ZEBRA: Repeated Non-Finalized Shielded Transaction Aborts Zebra Before Duplicate-Nullifier Rejection (CVSS 5.9)
- [CVE-2026-52734](https://cve.now/CVE-2026-52734.md): ZEBRA: Unbounded memory leak in mempool download pipeline via timeout path cancel\_handles retention (CVSS 5.3)
- [CVE-2026-52737](https://cve.now/CVE-2026-52737.md): ZEBRA: Sync restart poisoning from single unauthenticated peer via above-lookahead block (CVSS 5.3)
- [CVE-2026-54496](https://cve.now/CVE-2026-54496.md): Missing copy constraint in halo2\_gadgets variable-base scalar multiplication allows under-constrained base, breaking Orchard Action circuit soundness (CVSS 9.3)
- [CVE-2026-44499](https://cve.now/CVE-2026-44499.md): ZEBRA: Permanent Block Discovery Halt via Gossip Queue Saturation and Syncer Poisoning (CVSS 8.7)
- [CVE-2026-44500](https://cve.now/CVE-2026-44500.md): ZEBRA: Allocation Amplification in Inbound Network Deserializers (CVSS 5.3)
- [CVE-2026-44498](https://cve.now/CVE-2026-44498.md): ZEBRA: Block Validator Undercounts Coinbase and P2SH Sigops (CVSS 9.2)
- [CVE-2026-44497](https://cve.now/CVE-2026-44497.md): ZEBRA: Consensus Divergence in Transparent Sighash Hash-Type Handling due to Stale Buffer (CVSS 9.3)
- [CVE-2026-41585](https://cve.now/CVE-2026-41585.md): ZEBRA: Denial of Service via Interrupted JSON-RPC Requests from Authenticated Clients (CVSS 6.9)
- [CVE-2026-41584](https://cve.now/CVE-2026-41584.md): ZEBRA: rk Identity Point Panic in Transaction Verification (CVSS 9.2)
- [CVE-2026-41583](https://cve.now/CVE-2026-41583.md): ZEBRA: Consensus Divergence in Transparent Sighash Hash-Type Handling (CVSS 9.3)
- [CVE-2026-40881](https://cve.now/CVE-2026-40881.md): Zebra: addr/addrv2 Deserialization Resource Exhaustion (CVSS 6.3)
- [CVE-2026-40880](https://cve.now/CVE-2026-40880.md): Zebra: Cached Mempool Verification Bypasses Consensus Rules for Ahead-of-Tip Blocks (CVSS 7.2)
- [CVE-2026-34377](https://cve.now/CVE-2026-34377.md): Zebra has a Consensus Failure due to Improper Verification of V5 Transactions (CVSS 8.4)
- [CVE-2026-34202](https://cve.now/CVE-2026-34202.md): Zebra node crash — V5 transaction hash panic (P2P reachable) (CVSS 9.2)
- [CVE-2025-58359](https://cve.now/CVE-2025-58359.md): frost-core: refresh shares with smaller min\_signers will reduce group security (CVSS 6.0)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/zcashfoundation
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.