Quick answers
- Is CVE-2026-104434 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-104434 being exploited in the wild.
- How severe is CVE-2026-104434?
- Medium severity, with a CVSS score of 6.5, published 2 October 2026.
- Which products and versions are affected?
- Zcash Foundation Zebra-Rpc before 8.0.0; Zcash Foundation Zebrad before 4.5.0.
- Is there a fix for CVE-2026-104434?
- Yes: fixed in zebra-rpc 8.0.0; zebrad 4.5.0. Until then: Disable the RPC server by removing rpc.listen_addr from zebrad.toml. Ensure enable_cookie_auth = true (the default) and restrict filesystem access to the .cookie file. Alternatively, place a reverse proxy in front of the RPC port that rejects z_listunifiedreceivers calls with untrusted address parameters.</anigation> <parameter name="timeline">[ { "kind": "disclosed", "at": "2026-05-29", "note": "GitHub Security Advisory GHSA-c8w6-x74f-vmg3 published" }, { "kind": "advisory", "at": "2026-10-02", "note": "NVD entry published" } ] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-104434 attacked?
- It is attacked over the network.
- Am I affected by CVE-2026-104434?
- Check whether you run Zcash Foundation Zebra-Rpc or Zcash Foundation Zebrad at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- Fixed in: zebra-rpc 8.0.0; zebrad 4.5.0
Disable the RPC server by removing rpc.listen_addr from zebrad.toml. Ensure enable_cookie_auth = true (the default) and restrict filesystem access to the .cookie file. Alternatively, place a reverse proxy in front of the RPC port that rejects z_listunifiedreceivers calls with untrusted address parameters.</anigation> <parameter name="timeline">[ { "kind": "disclosed", "at": "2026-05-29", "note": "GitHub Security Advisory GHSA-c8w6-x74f-vmg3 published" }, { "kind": "advisory", "at": "2026-10-02", "note": "NVD entry published" } ]
Technical details
The z_listunifiedreceivers RPC handler performs only structural validation of Unified Addresses via zcash_address::unified::Encoding::decode, which does not verify that embedded Sapling receivers contain valid Jubjub subgroup points. It then calls .expect() on sapling_crypto::PaymentAddress::from_bytes without error handling; when the cryptographic validation fails for invalid Jubjub points, the assertion fires and terminates the process (panic = "abort" in release builds). Exploitation requires RPC authentication, which defaults to cookie-based access (typically local) but can be network-accessible if enable_cookie_auth is disabled.
Affected products
- Zcash Foundation zebra-rpc before 8.0.0
- Zcash Foundation zebrad before 4.5.0