Zcashfoundation vulnerabilities
52 CVEs and advisories name Zcashfoundation as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-52736ZEBRA: Block suppression via NU5 same-header body poisoning of sent-hash cache
- CVE-2026-52732ZEBRA: Mempool transaction admission denial via single-peer inbound queue saturation
- CVE-2026-52731ZEBRA: Full node denial of service via non-ASCII LongPollId in getblocktemplate
- CVE-2026-52733ZEBRA: Persistent on-disk corruption of Sapling/Orchard subtree roots after chain fork via pop_tip
- CVE-2026-52738ZEBRA: Finalized address balance credit-first overflow on consensus-valid blocks
- CVE-2026-52735ZEBRA: Consensus divergence via P2SH sigop undercount in pure-Rust disabled-opcode parser
- CVE-2026-52739ZEBRA: Repeated Non-Finalized Shielded Transaction Aborts Zebra Before Duplicate-Nullifier Rejection
- CVE-2026-52734ZEBRA: Unbounded memory leak in mempool download pipeline via timeout path cancel_handles retention
- CVE-2026-52737ZEBRA: Sync restart poisoning from single unauthenticated peer via above-lookahead block
- CVE-2026-54496Missing copy constraint in halo2_gadgets variable-base scalar multiplication allows under-constrained base, breaking Orchard Action circuit soundness
- CVE-2026-44499ZEBRA: Permanent Block Discovery Halt via Gossip Queue Saturation and Syncer Poisoning
- CVE-2026-44500ZEBRA: Allocation Amplification in Inbound Network Deserializers
- CVE-2026-44498ZEBRA: Block Validator Undercounts Coinbase and P2SH Sigops
- CVE-2026-44497ZEBRA: Consensus Divergence in Transparent Sighash Hash-Type Handling due to Stale Buffer
- CVE-2026-41585ZEBRA: Denial of Service via Interrupted JSON-RPC Requests from Authenticated Clients
- CVE-2026-41584ZEBRA: rk Identity Point Panic in Transaction Verification
- CVE-2026-41583ZEBRA: Consensus Divergence in Transparent Sighash Hash-Type Handling
- CVE-2026-40881Zebra: addr/addrv2 Deserialization Resource Exhaustion
- CVE-2026-40880Zebra: Cached Mempool Verification Bypasses Consensus Rules for Ahead-of-Tip Blocks
- CVE-2026-34377Zebra has a Consensus Failure due to Improper Verification of V5 Transactions
- CVE-2026-34202Zebra node crash — V5 transaction hash panic (P2P reachable)
- CVE-2025-58359frost-core: refresh shares with smaller min_signers will reduce group security