CVE-2026-44500: ZcashFoundation Zebra denial of service via allocation amplification

CVE-2026-44500 · Severity: medium · CVSS 5.3 · Published 2026-05-08

Zebra, a software implementation of the Zcash cryptocurrency node, is vulnerable to a denial-of-service attack. An attacker can send specially crafted network messages that trick the node into allocating excessive amounts of memory before it realizes the data is invalid. This can lead to memory exhaustion, causing the node to slow down or crash, potentially disrupting its ability to process transactions or stay synced with the network.

Technologies: zebra-chain (crates.io), zebra-network (crates.io), zebrad (crates.io), Zcash Foundation Zebra, Zfnd Zebrad. Vendors: crates.io, Zcash Foundation, Zfnd.

Quick answers

Is CVE-2026-44500 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-44500 being exploited in the wild.
How severe is CVE-2026-44500?
Medium severity, with a CVSS score of 5.3, published 8 May 2026.
Which products and versions are affected?
zebra-chain (crates.io) <= 6.0.3, SEMVER:introduced=0,fixed=7.0.0; zebra-network (crates.io) <= 5.0.2, SEMVER:introduced=0,fixed=6.0.0; zebrad (crates.io) < 4.4.0, SEMVER:introduced=0,fixed=4.4.0; Zcash Foundation Zebra < 4.4.0.
Is there a fix for CVE-2026-44500?
Yes. zebra-chain (crates.io): upgrade to 7.0.0 or later; zebra-network (crates.io): upgrade to 6.0.0 or later; zebrad (crates.io): upgrade to 4.4.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-44500 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-44500?
Check whether you run zebra-chain (crates.io), zebra-network (crates.io), zebrad (crates.io) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • zebra-chain (crates.io): upgrade to 7.0.0 or later
    cargo update -p zebra-chain
  • zebra-network (crates.io): upgrade to 6.0.0 or later
    cargo update -p zebra-network
  • zebrad (crates.io): upgrade to 4.4.0 or later
    cargo update -p zebrad

Technical details

Zebra's network codec uses 'TrustedPreallocate' and generic 'Vec' deserialization to bound inbound message parsing. A vulnerability exists where several deserialization paths (including headers messages, Equihash solutions, Sapling spend vectors, and coinbase script bytes) used generic transport or block-size ceilings as allocation bounds rather than stricter protocol or consensus limits. An unauthenticated or post-handshake peer can send messages with inflated size counts, forcing the node to preallocate memory for orders of magnitude more data than the protocol allows before the tighter limits are enforced and the message is rejected. This results in a memory-based Denial of Service (DoS) that can be amplified across multiple concurrent peer connections. The issue is fixed in Zebra version 4.4.0.

Affected products

  • ZcashFoundation zebrad < 4.4.0
  • ZcashFoundation zebra-chain <= 6.0.3
  • ZcashFoundation zebra-network <= 5.0.2

Identifiers

  • CVE-2026-44500
  • GHSA-438q-jx8f-cccv

Timeline

  • 2026-05-02: disclosed
  • 2026-05-07: advisory
  • 2026-05-08: other: NVD published CVE-2026-44500

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.