# CVE-2026-104434: Zcash Foundation Zebra reachable assertion in z_listunifiedreceivers RPC handler

Source: https://junglewise.ai/threats/cve-2026-104434-zcashfoundation-zebra-zebra-rpc-before-8-0-0-and-zebrad-before-4  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-02. Updated: 2026-10-05  
License: CC BY 4.0 with a link back

CVE-2026-104434 · Severity: medium · CVSS 6.5 · Published 2026-10-02

Zcash Foundation Zebra is a full node implementation for the Zcash blockchain. An authenticated RPC client can submit a specially crafted Unified Address to crash the zebrad process, causing a denial of service. The attack is repeatable, allowing an attacker to keep the node offline indefinitely until filtering is applied upstream.

Technologies: [Zcash Foundation Zebrad](https://junglewise.ai/threats/technologies/zcash-foundation-zebrad). Vendors: [Zcash Foundation](https://junglewise.ai/threats/vendors/zcash-foundation).

## Quick answers

**Is CVE-2026-104434 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-104434 being exploited in the wild.

**How severe is CVE-2026-104434?** Medium severity, with a CVSS score of 6.5, published 2 October 2026.

**Which products and versions are affected?** Zcash Foundation Zebra-Rpc before 8.0.0; Zcash Foundation Zebrad before 4.5.0.

**Is there a fix for CVE-2026-104434?** Yes: fixed in zebra-rpc 8.0.0; zebrad 4.5.0. Until then: Disable the RPC server by removing rpc.listen_addr from zebrad.toml. Ensure enable_cookie_auth = true (the default) and restrict filesystem access to the .cookie file. Alternatively, place a reverse proxy in front of the RPC port that rejects z_listunifiedreceivers calls with untrusted address parameters.</anigation>
<parameter name="timeline">[
  {
    "kind": "disclosed",
    "at": "2026-05-29",
    "note": "GitHub Security Advisory GHSA-c8w6-x74f-vmg3 published"
  },
  {
    "kind": "advisory",
    "at": "2026-10-02",
    "note": "NVD entry published"
  }
] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-104434 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-104434?** Check whether you run Zcash Foundation Zebra-Rpc or Zcash Foundation Zebrad at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in zebra-rpc 8.0.0; zebrad 4.5.0

Disable the RPC server by removing rpc.listen_addr from zebrad.toml. Ensure enable_cookie_auth = true (the default) and restrict filesystem access to the .cookie file. Alternatively, place a reverse proxy in front of the RPC port that rejects z_listunifiedreceivers calls with untrusted address parameters.</anigation>
<parameter name="timeline">[
  {
    "kind": "disclosed",
    "at": "2026-05-29",
    "note": "GitHub Security Advisory GHSA-c8w6-x74f-vmg3 published"
  },
  {
    "kind": "advisory",
    "at": "2026-10-02",
    "note": "NVD entry published"
  }
]

## Technical details

The z_listunifiedreceivers RPC handler performs only structural validation of Unified Addresses via zcash_address::unified::Encoding::decode, which does not verify that embedded Sapling receivers contain valid Jubjub subgroup points. It then calls .expect() on sapling_crypto::PaymentAddress::from_bytes without error handling; when the cryptographic validation fails for invalid Jubjub points, the assertion fires and terminates the process (panic = "abort" in release builds). Exploitation requires RPC authentication, which defaults to cookie-based access (typically local) but can be network-accessible if enable_cookie_auth is disabled.

## Affected products

- Zcash Foundation zebra-rpc before 8.0.0
- Zcash Foundation zebrad before 4.5.0

## References

- [https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-c8w6-x74f-vmg3](https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-c8w6-x74f-vmg3)
- [https://www.vulncheck.com/advisories/zebra-before-8.0.0-denial-of-service-via-z-listunifiedreceivers-rpc](https://www.vulncheck.com/advisories/zebra-before-8.0.0-denial-of-service-via-z-listunifiedreceivers-rpc)

## Related threats

- [Zebra zebrad denial of service in checkpoint sync verification](https://junglewise.ai/threats/cve-2026-123558-zebra-zebrad-before-7-0-0-contains-a-denial-of-service)
- [Zcash zebrad quadratic work in mempool coinbase-maturity check](https://junglewise.ai/threats/cve-2026-123554-zebra-zebrad-6-4-0-before-7-0-0-performs-quadratic-work-in-the)
- [Zebra consensus rule enforcement bypass in V5 SIGHASH_SINGLE](https://junglewise.ai/threats/cve-2026-104435-zebra-zebrad-4-4-0-and-zebra-script-6-0-0-fail-to-enforce-a-zip)
- [Zebra P2SH sigop counting consensus divergence](https://junglewise.ai/threats/cve-2026-104430-zebra-zebrad-4-5-0-and-zebra-script-7-0-0-count-p2sh-redeem)