Vulnerabilities

TI-2026-66078 CVE-2026-104436 · GHSA-4m38-rccq-j8gv

Zebra before 4.5.0 CPU Amplification via Uncapped getblocks/getheaders Locator Length

LOW 28

Zebra before 4.5.0 contains an uncontrolled resource consumption vulnerability that allows remote P2P peers to exhaust blocking-pool threads by sending oversized block locator vectors.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00273 Published 2026-10-02 Fixed in 4.5.0, 8.0.0 CWE-770

TI-2026-66076 CVE-2026-104434 · GHSA-fxgv-g76m-8hg2

Zebra before 8.0.0 Denial of Service via z_listunifiedreceivers RPC

LOW 31

ZcashFoundation Zebra zebra-rpc before 8.0.0 and zebrad before 4.5.0 contain a reachable assertion in the z_listunifiedreceivers RPC handler, which calls expect() on Sapling receiver parsing that fails for Unified Addres…

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00307 Published 2026-10-02 Fixed in 8.0.0, 4.5.0 CWE-617

Vulnerabilities

Filters

Zebra before 4.5.0 CPU Amplification via Uncapped getblocks/getheaders Locator Length

Zebra before 8.0.0 Denial of Service via z_listunifiedreceivers RPC