Insufficient verification of data authenticity in ZcashFoundation zebra
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- None · High · Low
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-345.
Summary
ZEBRA is a Zcash node written entirely in Rust. Prior to zebrad 5.0.0, halo2_gadgets 0.5.0, orchard 0.14.0, zcash_primitives 0.28.0, and zcashd 6.20.0, the variable-base scalar multiplication gadget in halo2_gadgets/src/ecc/chip/mul/incomplete.rs used assign_advice() for the base point without a copy constraint tying it to the actual base, allowing a malicious prover to produce a valid proof for an Orchard Action with an under-constrained base point and bypass the diversified-address-integrity check that binds pk_d, g_d, ivk, the nullifier (nf), and the spend validating key (ak) to the note being spent. This issue is fixed in zebrad 5.0.0, halo2_gadgets 0.5.0, orchard 0.14.0, zcash_primitives 0.28.0, and zcashd 6.20.0.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| ZcashFoundation | zebra | before 5.0.0 | 5.0.0 | Patch available | CNA |
| Zcash | halo2_gadgets | before 0.5.0 | 0.5.0 | Patch available | CNA |
| Zcash | orchard | before 0.14.0 | 0.14.0 | Patch available | CNA |
| Zcash | librustzcash | before 0.28.0 | 0.28.0 | Patch available | CNA |
| Zcash | zcash | before 6.20.0 | 6.20.0 | Patch available | CNA |
| — | zebrad (crates.io) | before 5.0.0 | 5.0.0 | Patch available | GHSA-ww9q-8r59-xv46 |
| — | halo2_gadgets (crates.io) | before 0.5.0 | 0.5.0 | Patch available | GHSA-ww9q-8r59-xv46 |
| — | orchard (crates.io) | before 0.14.0 | 0.14.0 | Patch available | GHSA-ww9q-8r59-xv46 |
| — | zcash_primitives (crates.io) | before 0.28.0 | 0.28.0 | Patch available | GHSA-ww9q-8r59-xv46 |
- zebra VendorZcashFoundation Affected before 5.0.0 Fixed in 5.0.0 Patch available CNA
- halo2_gadgets VendorZcash Affected before 0.5.0 Fixed in 0.5.0 Patch available CNA
- orchard VendorZcash Affected before 0.14.0 Fixed in 0.14.0 Patch available CNA
- librustzcash VendorZcash Affected before 0.28.0 Fixed in 0.28.0 Patch available CNA
- zcash VendorZcash Affected before 6.20.0 Fixed in 6.20.0 Patch available CNA
- zebrad (crates.io) Vendor— Affected before 5.0.0 Fixed in 5.0.0 Patch available GHSA-ww9q-8r59-xv46
- halo2_gadgets (crates.io) Vendor— Affected before 0.5.0 Fixed in 0.5.0 Patch available GHSA-ww9q-8r59-xv46
- orchard (crates.io) Vendor— Affected before 0.14.0 Fixed in 0.14.0 Patch available GHSA-ww9q-8r59-xv46
- zcash_primitives (crates.io) Vendor— Affected before 0.28.0 Fixed in 0.28.0 Patch available GHSA-ww9q-8r59-xv46
Remediation
- Fix · CNA zebra (ZcashFoundation) Fixed in 5.0.0
- Fix · CNA halo2_gadgets (zcash) Fixed in 0.5.0
- Fix · CNA orchard (zcash) Fixed in 0.14.0
- Fix · CNA librustzcash (zcash) Fixed in 0.28.0
- Fix · CNA zcash (zcash) Fixed in 6.20.0
- Fix · GHSA-ww9q-8r59-xv46 zebrad (crates.io) Fixed in 5.0.0 Advisory →
- Fix · GHSA-ww9q-8r59-xv46 halo2_gadgets (crates.io) Fixed in 0.5.0 Advisory →
- Fix · GHSA-ww9q-8r59-xv46 orchard (crates.io) Fixed in 0.14.0 Advisory →
- Fix · GHSA-ww9q-8r59-xv46 zcash_primitives (crates.io) Fixed in 0.28.0 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2026-54496
- 2026-10-03 Alias added: GHSA-ww9q-8r59-xv46
References
Other 8
- https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-ww9q-8r59-xv46
- https://github.com/ZcashFoundation/zebra/releases/tag/v5.0.0
- https://github.com/zcash/halo2/releases/tag/halo2_gadgets-0.5.0
- https://github.com/zcash/librustzcash/releases/tag/zcash_primitives-0.28.0
- https://github.com/zcash/orchard/releases/tag/0.14.0
- https://github.com/zcash/zcash/releases/tag/v6.20.0
- https://zfnd.org/zebra-4-5-3-and-5-0-0-emergency-soft-fork-and-nu6-2-activation
- https://github.com/ZcashFoundation/zebra
More ZcashFoundation vulnerabilities
- TI-2026-66079 Zebra before 4.4.0 Consensus Split via SIGHASH_SINGLE Missing-Output Handling CVSS 4.0HIGH 8.3
- TI-2026-37850 ZEBRA: Mempool transaction admission denial via single-peer inbound queue saturation CVSS 3.1MEDIUM 5.3
- TI-2026-71182 Improper block validation in Zebra gossip lets peers drop new blocks CVSS 4.0MEDIUM 6.3
- TI-2026-29537 Zebra: addr/addrv2 Deserialization Resource Exhaustion CVSS 4.0MEDIUM 6.3
- TI-2026-30136 ZEBRA: Consensus Divergence in Transparent Sighash Hash-Type Handling CVSS 4.0CRITICAL 9.3
- TI-2026-37853 ZEBRA: Consensus divergence via P2SH sigop undercount in pure-Rust disabled-opcode parser CVSS 4.0CRITICAL 9.3
Sources
- CVE-2026-54496 · CVE Program
- CVE-2026-54496 · NVD
- FIRST EPSS
- GHSA-ww9q-8r59-xv46 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences