CVE-2026-52829: ZEBRA is a Zcash node written entirely in Rust. Prior to 4.5.0, an unauthenticated IPv4 peer can deterministically terminate a synced Zebra

Executive brief

Zebra, a Zcash node implementation, is vulnerable to a remote crash that can be triggered by an unauthenticated attacker. By sending a single invalid transaction, an attacker can cause the node to shut down unexpectedly, leading to persistent service downtime. This affects nodes running on Linux with default network settings when they are synchronized with the blockchain network.

Technical details

A reachable assertion vulnerability exists in Zebra due to inconsistent handling of IPv4-mapped IPv6 addresses. While the handshake path canonicalizes these addresses to plain IPv4, the mempool misbehavior path (via `MetaAddrChange::UpdateMisbehavior`) uses the raw transient socket address. When a peer triggers a misbehavior penalty, the `AddressBook::update` function attempts to apply the change, but an assertion fails because the stored canonical IPv4 address does not match the raw IPv4-mapped IPv6 address provided in the update. An unauthenticated remote attacker can exploit this by completing a P2P handshake over IPv4 and advertising an invalid transaction, causing the node to panic and abort after a 30-second flush interval. The issue is patched in zebrad v4.5.0 and zebra-network v7.0.0.

Affected products

• ZcashFoundation zebrad <= 4.4.1
• ZcashFoundation zebra-network <= 6.0.0

Timeline

• 2026-05-29: disclosed
• 2026-07-02: advisory

References

• https://api.github.com/users/Haxatron
• https://github.com/Haxatron
• https://api.github.com/users/Haxatron/gists%7B/gist_id%7D
• https://api.github.com/users/Haxatron/repos
• https://avatars.githubusercontent.com/u/76475453?v=4
• https://api.github.com/users/Haxatron/events%7B/privacy%7D