# CVE-2026-104428: Zcash Foundation Zebra getblock RPC denial of service

Source: https://junglewise.ai/threats/cve-2026-104428-the-getblock-rpc-method-in-zebra-rpc-before-11-0-0-used-by-the  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-02. Updated: 2026-10-05  
License: CC BY 4.0 with a link back

CVE-2026-104428 · Severity: medium · CVSS 5.3 · Published 2026-10-02

Zebra is a node implementation for the Zcash cryptocurrency network. A flaw in the getblock RPC method causes the node process to crash when handling a specific query about blocks not on the main chain, allowing remote attackers to repeatedly knock the node offline. The crash can be triggered remotely without authentication, either directly or through lightwalletd relay services.

Technologies: [Zcash Foundation Zebra](https://junglewise.ai/threats/technologies/zebra). Vendors: [Zcash Foundation](https://junglewise.ai/threats/vendors/zcash-foundation).

## Quick answers

**Is CVE-2026-104428 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-104428 being exploited in the wild.

**How severe is CVE-2026-104428?** Medium severity, with a CVSS score of 5.3, published 2 October 2026.

**Which products and versions are affected?** Zcash Foundation Zebra before 11.0.0.

**Is there a fix for CVE-2026-104428?** Yes: fixed in 11.0.0. Until then: Keep RPC cookie authentication enabled and restrict the RPC port to trusted networks only. Note that this does not protect against calls forwarded through lightwalletd, which relays the getblock method; upgrading to the patched version is the durable fix. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-104428 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-104428?** Check whether you run Zcash Foundation Zebra at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 11.0.0

Keep RPC cookie authentication enabled and restrict the RPC port to trusted networks only. Note that this does not protect against calls forwarded through lightwalletd, which relays the getblock method; upgrading to the patched version is the durable fix.

## Technical details

The getblock RPC method with verbosity level 2 attempts to convert a confirmations value from i64 to u32 using .expect(), which panics when the value is -1 (the sentinel for blocks not on the best chain). Because the Zebra workspace sets panic = "abort", the panic terminates the entire node process. An unauthenticated remote attacker can trigger this by calling getblock with a side-chain block hash and verbosity 2, then repeat the call to maintain a denial of service.

## Affected products

- Zcash Foundation Zebra before 11.0.0

## Timeline

- 2026-07-03: disclosed
- 2026-10-02: advisory

## References

- [https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-x6v8-c2xp-928m](https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-x6v8-c2xp-928m)
- [https://www.vulncheck.com/advisories/zebra-before-11.0.0-denial-of-service-via-getblock-verbosity-2](https://www.vulncheck.com/advisories/zebra-before-11.0.0-denial-of-service-via-getblock-verbosity-2)

## Related threats

- [Zebra incomplete cleanup in checkpoint sync stalls initial sync](https://junglewise.ai/threats/cve-2026-123560-zebra-before-7-0-0-contains-an-incomplete-cleanup-vulnerability)
- [Zebra denial of service via quadratic sighash computation](https://junglewise.ai/threats/cve-2026-123559-zebra-before-7-0-0-contains-an-inefficient-algorithmic)
- [Zcash Foundation Zebra zebrad reachable assertion denial of service](https://junglewise.ai/threats/cve-2026-123557-zcashfoundation-zebra-zebrad-before-7-0-0-contains-a-reachable)
- [Zcash Foundation Zebra protection mechanism failure in mempool lock-time scoring](https://junglewise.ai/threats/cve-2026-123556-zcashfoundation-zebra-from-4-5-0-before-7-0-0-contains-a)
- [Zebra misbehavior scoring bypass via invalid script verification](https://junglewise.ai/threats/cve-2026-123555-zebra-from-2-3-0-before-7-0-0-contains-a-denial-of-service)