CVE-2026-44499: Zcash Foundation Zebra Denial of Service in block discovery pipeline

CVE-2026-44499 · Severity: high · CVSS 4 · Published 2026-05-08

A vulnerability in Zebra, a software node for the Zcash cryptocurrency network, allows a remote attacker to permanently stop the node from receiving new transaction blocks. By exploiting weaknesses in how the software communicates with peers, an attacker can force a node to fall behind the rest of the network indefinitely. This results in a total service outage for the affected node that requires manual intervention by an administrator to fix.

Technologies: zebrad (crates.io), Zcash Foundation Zebra. Vendors: crates.io, Zcash Foundation.

Quick answers

Is CVE-2026-44499 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-44499 being exploited in the wild.
How severe is CVE-2026-44499?
High severity, with a CVSS score of 4, published 8 May 2026.
Which products and versions are affected?
zebrad (crates.io) < 4.4.0, SEMVER:introduced=0,fixed=4.4.0; Zcash Foundation Zebra < 4.4.0.
Is there a fix for CVE-2026-44499?
Yes. zebrad (crates.io): upgrade to 4.4.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-44499 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-44499?
Check whether you run zebrad (crates.io) or Zcash Foundation Zebra at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • zebrad (crates.io): upgrade to 4.4.0 or later
    cargo update -p zebrad

Technical details

The vulnerability stems from three independent weaknesses in Zebra's gossip, syncer, and download subsystems. First, the gossip path lacked per-connection rate limiting on 'inv' messages, allowing an attacker to saturate the download queue with fake hashes. Second, the system silently ignored queue-full errors, dropping legitimate announcements. Third, the syncer path could be poisoned by providing empty responses to block discovery queries, which carried no misbehavior penalty and did not trigger a peer ban. By combining these vectors from a single TCP connection, an attacker can suppress all block discovery mechanisms, causing the node to fall permanently behind the chain tip. This is fixed in version 4.4.0 by implementing stricter peer validation and dropping connections that provide empty responses to sync requests.

Affected products

  • Zcash Foundation Zebra (zebrad) < 4.4.0

Identifiers

  • CVE-2026-44499
  • GHSA-h9hm-m2xj-4rq9

Timeline

  • 2026-05-05: disclosed
  • 2026-05-08: advisory
  • 2026-05-08: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.