Executive brief
Zebra, a software implementation of the Zcash cryptocurrency node, is vulnerable to a denial-of-service attack. An attacker can send specially crafted network messages that trick the node into allocating excessive amounts of memory before it realizes the data is invalid. This can lead to memory exhaustion, causing the node to slow down or crash, potentially disrupting its ability to process transactions or stay synced with the network.
Technical details
Zebra's network codec uses 'TrustedPreallocate' and generic 'Vec' deserialization to bound inbound message parsing. A vulnerability exists where several deserialization paths (including headers messages, Equihash solutions, Sapling spend vectors, and coinbase script bytes) used generic transport or block-size ceilings as allocation bounds rather than stricter protocol or consensus limits. An unauthenticated or post-handshake peer can send messages with inflated size counts, forcing the node to preallocate memory for orders of magnitude more data than the protocol allows before the tighter limits are enforced and the message is rejected. This results in a memory-based Denial of Service (DoS) that can be amplified across multiple concurrent peer connections. The issue is fixed in Zebra version 4.4.0.
Affected products
- ZcashFoundation zebrad < 4.4.0
- ZcashFoundation zebra-chain <= 6.0.3
- ZcashFoundation zebra-network <= 5.0.2
Timeline
- 2026-05-02: disclosed
- 2026-05-07: advisory
- 2026-05-08: other: NVD published CVE-2026-44500