Vulnerabilities

TI-2026-39342 CVE-2026-54496 · GHSA-ww9q-8r59-xv46

Insufficient verification of data authenticity in ZcashFoundation zebra

MEDIUM 46

ZEBRA is a Zcash node written entirely in Rust.

CVSS 3.1CRITICAL 9.3 Network No auth No interaction EPSS 0.00315 Published 2026-07-17 Fixed in 5.0.0, 0.5.0 +3 CWE-345

TI-2026-27778 CVE-2026-35679 · GHSA-mh64-f367-wjjw

Zcash zcashd before 6.12.0 allows invalid transactions to be accepted under certain…

LOW 16

Zcash zcashd before 6.12.0 allows invalid transactions to be accepted under certain conditions, which potentially could have resulted in the draining of user funds from the Sprout pool.

CVSS 3.1LOW 3.5 Network Low privileges No interaction EPSS 0.00224 Published 2026-04-05 Fixed in 6.12.0 CWE-358

TI-2019-12629 CVE-2019-16930 · GHSA-x2rm-rw73-q2w8

Zcashd in Zcash before 2.0.7-3 allows discovery of the IP address of a full node that…

LOW 27

Zcashd in Zcash before 2.0.7-3 allows discovery of the IP address of a full node that owns a shielded address, related to mishandling of exceptions during deserialization of note plaintexts.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.01636 Published 2019-09-28 No fix listed CWE-755

TI-2019-08706 CVE-2019-11636 · GHSA-p5ww-mxg5-8q8m

Zcash 2.x allows an inexpensive approach to "fill all transactions of all blocks" and…

LOW 37

Zcash 2.x allows an inexpensive approach to "fill all transactions of all blocks" and "prevent any real transaction from occurring" via a "Sapling Wood-Chipper" attack.

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.0218 Published 2019-05-01 No fix listed CWE-254

TI-2019-05084 CVE-2019-7167 · GHSA-q567-c5xf-8xjf

Zcash, before the Sapling network upgrade (2018-10-28), had a counterfeiting…