All vulnerabilities
CVE-2026-104434GHSA-c8w6-x74f-vmg3

Zebra before 8.0.0 Denial of Service via z_listunifiedreceivers RPC

ZcashFoundation zebracrates.ioLibraries & packages
Open in ThreatlineRecord JSON
CVSS
7.1High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.31%Chance of exploitation activity in the next 30 days, higher than 22% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in8.0.0Also 4.5.0CVE List
Published2 Oct 2026Updated 3 Oct 2026CVE List

What fixes it

  • 8.0.0zebraCVE List
  • 4.5.0zebraCVE List
  • 8.0.0zebra-rpc, crates.ioOSVcargo update -p zebra-rpc --precise 8.0.0
  • 4.5.0zebrad, crates.ioOSVcargo update -p zebrad --precise 4.5.0

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

ZcashFoundation Zebra zebra-rpc before 8.0.0 and zebrad before 4.5.0 contain a reachable assertion in the z_listunifiedreceivers RPC handler, which calls expect() on Sapling receiver parsing that fails for Unified Addresses carrying invalid Jubjub points. Authenticated RPC clients can submit such an address to abort the zebrad process, repeatably keeping the node offline.

Text from CVE List

Affected versions 6

  • zebraaffected: all versions before 8.0.0CVE List
  • zebraunaffected: 8.0.0CVE List
  • zebraaffected: all versions before 4.5.0CVE List
  • zebraunaffected: 4.5.0CVE List
  • zebra-rpc, crates.iofrom first release, fixed in 8.0.0OSV
  • zebrad, crates.iofrom first release, fixed in 4.5.0OSV

References 2