ZEBRA: Allocation Amplification in Inbound Network Deserializers
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · Low
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-770.
Summary
ZEBRA is a Zcash node written entirely in Rust. Prior to zebrad version 4.4.0, prior to zebra-chain version 7.0.0, and prior to zebra-network version 6.0.0, several inbound deserialization paths in Zebra allocated buffers sized against generic transport or block-size ceilings before the tighter protocol or consensus limits were enforced. An unauthenticated or post-handshake peer could therefore force the node to preallocate and parse for orders of magnitude more data than the protocol intended, across headers messages, equihash solutions in block headers, Sapling spend vectors in V5/V4 transactions, and coinbase script bytes in blocks. This issue has been patched in zebrad version 4.4.0, zebra-chain version 7.0.0, and zebra-network version 6.0.0.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| ZcashFoundation | zebra | zebrad < 4.4.0; zebra-chain < 7.0.0; zebra-network < 6.0.0 | — | No fix listed | CNA |
| — | zebra-network (crates.io) | before 6.0.0 | 6.0.0 | Patch available | GHSA-438q-jx8f-cccv |
| — | zebrad (crates.io) | before 4.4.0 | 4.4.0 | Patch available | GHSA-438q-jx8f-cccv |
| — | zebra-chain (crates.io) | before 7.0.0 | 7.0.0 | Patch available | GHSA-438q-jx8f-cccv |
- zebra VendorZcashFoundation Affected zebrad < 4.4.0; zebra-chain < 7.0.0; zebra-network < 6.0.0 Fixed in — No fix listed CNA
- zebra-network (crates.io) Vendor— Affected before 6.0.0 Fixed in 6.0.0 Patch available GHSA-438q-jx8f-cccv
- zebrad (crates.io) Vendor— Affected before 4.4.0 Fixed in 4.4.0 Patch available GHSA-438q-jx8f-cccv
- zebra-chain (crates.io) Vendor— Affected before 7.0.0 Fixed in 7.0.0 Patch available GHSA-438q-jx8f-cccv
CPE configurations NVD · 3
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:zfnd:zebra-chain:*:*:*:*:*:rust:*:* | before 7.0.0 | Vulnerable | ZcashFoundation |
| cpe:2.3:a:zfnd:zebra-network:*:*:*:*:*:rust:*:* | before 6.0.0 | Vulnerable | ZcashFoundation |
| cpe:2.3:a:zfnd:zebrad:*:*:*:*:*:rust:*:* | before 4.4.0 | Vulnerable | ZcashFoundation |
- cpe:2.3:a:zfnd:zebra-chain:*:*:*:*:*:rust:*:* Versions before 7.0.0 Vulnerable ·ZcashFoundation
- cpe:2.3:a:zfnd:zebra-network:*:*:*:*:*:rust:*:* Versions before 6.0.0 Vulnerable ·ZcashFoundation
- cpe:2.3:a:zfnd:zebrad:*:*:*:*:*:rust:*:* Versions before 4.4.0 Vulnerable ·ZcashFoundation
Remediation
- Fix · GHSA-438q-jx8f-cccv zebra-network (crates.io) Fixed in 6.0.0 Advisory →
- Fix · GHSA-438q-jx8f-cccv zebrad (crates.io) Fixed in 4.4.0 Advisory →
- Fix · GHSA-438q-jx8f-cccv zebra-chain (crates.io) Fixed in 7.0.0 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2026-44500
- 2026-10-03 Alias added: GHSA-438q-jx8f-cccv
References
More ZcashFoundation Zebra-chain vulnerabilities
- TI-2026-26497 Zebra node crash — V5 transaction hash panic (P2P reachable) CVSS 4.0CRITICAL 9.2
- TI-2026-30137 ZEBRA: rk Identity Point Panic in Transaction Verification CVSS 4.0CRITICAL 9.2
Sources
- CVE-2026-44500 · CVE Program
- CVE-2026-44500 · NVD
- FIRST EPSS
- GHSA-438q-jx8f-cccv · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences