zebrad
by Zebra
CVEs (6)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2026-52735 | cri | 0.59 | — | — | Jul 2, 2026 | ### Am I affected You are affected if: 1. You run any version of `zebrad` up to and including `v4.4.1`. 2. Your node validates blocks on mainnet, testnet, or any network where both Zebra and zcashd nodes participate. All default configurations are affected. No feature flags,… | ||
| CVE-2026-52829 | hig | 0.45 | — | — | Jul 2, 2026 | ### Am I affected You are affected if: 1. You run `zebrad` up to and including `v4.4.1`. 2. Your node listens on the default `[::]` address on a Linux host (the standard deployment configuration — `net.ipv6.bindv6only=0` is the default on all common Linux distributions). 3.… | ||
| CVE-2026-52736 | hig | 0.45 | — | — | Jul 2, 2026 | ## Description ### Am I affected You are affected if: 1. You run any version of `zebrad` up to and including `v4.4.1`. 2. Your node accepts inbound P2P connections (`network.listen_addr` is set, which is the default). 3. Your node processes blocks past the checkpoint height… | ||
| CVE-2026-52739 | med | 0.26 | — | — | Jul 2, 2026 | ### Am I affected You are affected if: 1. You run `zebrad` up to and including `v4.4.1`. 2. Your node processes blocks past the checkpoint height (non-finalized state is active). 3. The network has NU5 or later activated. All default configurations are affected. ### Summary … | ||
| CVE-2026-52738 | med | 0.26 | — | — | Jul 2, 2026 | ### Am I affected You are affected if: 1. You run `zebrad` up to and including `v4.4.1`. 2. Your node processes blocks on any Zcash network. ### Summary The finalized transparent address balance writer processes all newly-created outputs (credits) before processing spent… | ||
| CVE-2026-52737 | med | 0.26 | — | — | Jul 2, 2026 | ### Am I affected You are affected if: 1. You run `zebrad` up to and including `v4.4.1`. 2. Your node accepts inbound P2P connections and is syncing or catching up to the chain tip. ### Summary A malicious peer can answer Zebra's outbound `getblocks`/`FindBlocks` request… |
- risk 0.59cvss —epss —
### Am I affected You are affected if: 1. You run any version of `zebrad` up to and including `v4.4.1`. 2. Your node validates blocks on mainnet, testnet, or any network where both Zebra and zcashd nodes participate. All default configurations are affected. No feature flags,…
- risk 0.45cvss —epss —
### Am I affected You are affected if: 1. You run `zebrad` up to and including `v4.4.1`. 2. Your node listens on the default `[::]` address on a Linux host (the standard deployment configuration — `net.ipv6.bindv6only=0` is the default on all common Linux distributions). 3.…
- risk 0.45cvss —epss —
## Description ### Am I affected You are affected if: 1. You run any version of `zebrad` up to and including `v4.4.1`. 2. Your node accepts inbound P2P connections (`network.listen_addr` is set, which is the default). 3. Your node processes blocks past the checkpoint height…
- risk 0.26cvss —epss —
### Am I affected You are affected if: 1. You run `zebrad` up to and including `v4.4.1`. 2. Your node processes blocks past the checkpoint height (non-finalized state is active). 3. The network has NU5 or later activated. All default configurations are affected. ### Summary …
- risk 0.26cvss —epss —
### Am I affected You are affected if: 1. You run `zebrad` up to and including `v4.4.1`. 2. Your node processes blocks on any Zcash network. ### Summary The finalized transparent address balance writer processes all newly-created outputs (credits) before processing spent…
- risk 0.26cvss —epss —
### Am I affected You are affected if: 1. You run `zebrad` up to and including `v4.4.1`. 2. Your node accepts inbound P2P connections and is syncing or catching up to the chain tip. ### Summary A malicious peer can answer Zebra's outbound `getblocks`/`FindBlocks` request…