CVE-2026-52829: ZcashFoundation Zebra assertion panic in address book mempool update

CVE-2026-52829 · Severity: high · CVSS 7.5 · Published 2026-08-18

Zebra, a Zcash node implementation, is vulnerable to a remote crash that can be triggered by an unauthenticated attacker. By sending a single invalid transaction, an attacker can cause the node to shut down unexpectedly, leading to persistent service downtime. This affects nodes running on Linux with default network settings when they are synchronized with the blockchain network.

Technologies: zebra-network (crates.io), zebrad (crates.io). Vendors: crates.io.

Quick answers

Is CVE-2026-52829 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-52829 being exploited in the wild.
How severe is CVE-2026-52829?
High severity, with a CVSS score of 7.5, published 18 August 2026.
Which products and versions are affected?
zebra-network (crates.io) <= 6.0.0, SEMVER:introduced=0,fixed=7.0.0; zebrad (crates.io) <= 4.4.1, SEMVER:introduced=0,fixed=4.5.0.
Is there a fix for CVE-2026-52829?
Yes. zebra-network (crates.io): upgrade to 7.0.0 or later; zebrad (crates.io): upgrade to 4.5.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-52829 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-52829?
Check whether you run zebra-network (crates.io) or zebrad (crates.io) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • zebra-network (crates.io): upgrade to 7.0.0 or later
    cargo update -p zebra-network
  • zebrad (crates.io): upgrade to 4.5.0 or later
    cargo update -p zebrad

Technical details

A reachable assertion vulnerability exists in Zebra due to inconsistent handling of IPv4-mapped IPv6 addresses. While the handshake path canonicalizes these addresses to plain IPv4, the mempool misbehavior path (via `MetaAddrChange::UpdateMisbehavior`) uses the raw transient socket address. When a peer triggers a misbehavior penalty, the `AddressBook::update` function attempts to apply the change, but an assertion fails because the stored canonical IPv4 address does not match the raw IPv4-mapped IPv6 address provided in the update. An unauthenticated remote attacker can exploit this by completing a P2P handshake over IPv4 and advertising an invalid transaction, causing the node to panic and abort after a 30-second flush interval. The issue is patched in zebrad v4.5.0 and zebra-network v7.0.0.

Affected products

  • ZcashFoundation zebrad <= 4.4.1
  • ZcashFoundation zebra-network <= 6.0.0

Identifiers

  • CVE-2026-52829
  • GHSA-63wg-wjjj-7cp8

Timeline

  • 2026-05-29: disclosed
  • 2026-07-02: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.