# zebrad (crates.io) vulnerabilities Source: https://junglewise.ai/threats/technologies/zebrad Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 9 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/zebrad.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 27 vulnerabilities in zebrad (crates.io): 0 in the last 7 days and 10 in the last 90 days, 6 of them critical and 0 exploited in the wild. The most recent, CVE-2026-52829, was published on 18 August 2026. Nothing was published in the last eight weeks. ## Counts - Last 7 days: 0 - Last 30 days: 0 - Last 90 days: 10 - All time: 27 (6 critical, 0 exploited in the wild) ## About zebrad (crates.io) Full-node implementation of the Zcash blockchain written in Rust. ## Latest zebrad (crates.io) vulnerabilities - [CVE-2026-52829: ZcashFoundation Zebra assertion panic in address book mempool update](https://junglewise.ai/threats/cve-2026-52829-zcashfoundation-zebra-assertion-panic-in-address-book-mempool) (high, CVSS 7.5, published 18 Aug 2026) - [CVE-2026-52739: ZcashFoundation Zebra process abort via repeated shielded transactions](https://junglewise.ai/threats/cve-2026-52739-zcashfoundation-zebra-process-abort-via-repeated-shielded) (medium, CVSS 5.9, published 18 Aug 2026) - [CVE-2026-52738: ZcashFoundation Zebra denial of service via balance overflow in state writer](https://junglewise.ai/threats/cve-2026-52738-zcashfoundation-zebra-denial-of-service-via-balance-overflow-in) (medium, CVSS 4, published 18 Aug 2026) - [CVE-2026-52737: Zcash Zebra sync restart poisoning via above-lookahead block](https://junglewise.ai/threats/cve-2026-52737-zcash-zebra-sync-restart-poisoning-via-above-lookahead-block) (medium, CVSS 5.3, published 18 Aug 2026) - [CVE-2026-52736: ZcashFoundation Zebra block suppression via same-header body poisoning](https://junglewise.ai/threats/cve-2026-52736-zcashfoundation-zebra-block-suppression-via-same-header-body) (high, CVSS 4, published 18 Aug 2026) - [CVE-2026-52735: Zcash Zebra consensus divergence via P2SH sigop undercount](https://junglewise.ai/threats/cve-2026-52735-zcash-zebra-consensus-divergence-via-p2sh-sigop-undercount) (critical, CVSS 4, published 18 Aug 2026) - [CVE-2026-52734: ZcashFoundation zebrad memory leak in mempool download pipeline](https://junglewise.ai/threats/cve-2026-52734-zcashfoundation-zebrad-memory-leak-in-mempool-download-pipeline) (medium, CVSS 5.3, published 18 Aug 2026) - [CVE-2026-52733: ZcashFoundation zebrad persistent state corruption in subtree roots](https://junglewise.ai/threats/cve-2026-52733-zcashfoundation-zebrad-persistent-state-corruption-in-subtree) (medium, CVSS 6.5, published 18 Aug 2026) - [CVE-2026-52732: ZcashFoundation zebrad denial of service in mempool inbound queue](https://junglewise.ai/threats/cve-2026-52732-zcashfoundation-zebrad-denial-of-service-in-mempool-inbound-queue) (medium, CVSS 5.3, published 18 Aug 2026) - [CVE-2026-52731: ZcashFoundation zebrad denial of service via non-ASCII LongPollId in getblocktemplate](https://junglewise.ai/threats/cve-2026-52731-zcashfoundation-zebrad-denial-of-service-via-non-ascii-longpollid) (medium, CVSS 6.5, published 18 Aug 2026) - [CVE-2026-54496: Zcash Orchard Action circuit soundness vulnerability in halo2_gadgets](https://junglewise.ai/threats/cve-2026-54496-zcash-orchard-action-circuit-soundness-vulnerability-in-halo2) (critical, CVSS 9.3, published 17 Jul 2026) - [Zcash Foundation Zebra resource exhaustion in P2P codec](https://junglewise.ai/threats/zcash-foundation-zebra-resource-exhaustion-in-p2p-codec-189d566f) (low, CVSS 3.7, published 2 Jul 2026) - [ZcashFoundation zebrad denial of service in z_listunifiedreceivers](https://junglewise.ai/threats/zcashfoundation-zebrad-denial-of-service-in-z-listunifiedreceivers-d7538689) (medium, CVSS 6.5, published 2 Jul 2026) - [Zcash Zebra CPU amplification in getblocks and getheaders handlers](https://junglewise.ai/threats/zcash-zebra-cpu-amplification-in-getblocks-and-getheaders-handlers-f019ca3b) (low, CVSS 3.7, published 2 Jul 2026) - [Zebra v4.4.0 still accepts V5 SIGHASH_SINGLE without a corresponding output](https://junglewise.ai/threats/zebra-v4-4-0-still-accepts-v5-sighash-single-without-a-corresponding-673d508e) (medium, CVSS 4, published 8 May 2026) - [CVE-2026-44499: Zcash Foundation Zebra Denial of Service in block discovery pipeline](https://junglewise.ai/threats/cve-2026-44499-zcash-foundation-zebra-denial-of-service-in-block-discovery) (high, CVSS 4, published 8 May 2026) - [CVE-2026-44500: ZcashFoundation Zebra denial of service via allocation amplification](https://junglewise.ai/threats/cve-2026-44500-zcashfoundation-zebra-denial-of-service-via-allocation) (medium, CVSS 5.3, published 8 May 2026) - [CVE-2026-41583: Zcash Foundation Zebra consensus divergence in sighash handling](https://junglewise.ai/threats/cve-2026-41583-zcash-foundation-zebra-consensus-divergence-in-sighash-handling) (critical, CVSS 9.1, published 8 May 2026) - [Zcash Zebra consensus divergence in SIGHASH_SINGLE handling](https://junglewise.ai/threats/zcash-zebra-consensus-divergence-in-sighash-single-handling-8969cdaa) (critical, CVSS 9.2, published 7 May 2026) - [CVE-2026-44497: Zcash Foundation Zebra consensus divergence in sighash handling](https://junglewise.ai/threats/cve-2026-44497-zcash-foundation-zebra-consensus-divergence-in-sighash-handling) (critical, CVSS 9.1, published 7 May 2026) - [CVE-2026-44498: Zcash Zebra consensus failure via sigop undercounting in block validator](https://junglewise.ai/threats/cve-2026-44498-zcash-zebra-consensus-failure-via-sigop-undercounting-in-block) (high, CVSS 7.5, published 7 May 2026) - [CVE-2026-40881: Zcash Foundation Zebra resource exhaustion in addr message deserialization](https://junglewise.ai/threats/cve-2026-40881-zcash-foundation-zebra-resource-exhaustion-in-addr-message) (high, CVSS 7.5, published 21 Apr 2026) - [CVE-2026-40880: Zebra: Cached Mempool Verification Bypasses Consensus Rules for Ahead-of-Tip Blocks](https://junglewise.ai/threats/cve-2026-40880-zebra-cached-mempool-verification-bypasses-consensus-rules-for) (high, CVSS 8.1, published 21 Apr 2026) - [CVE-2026-41585: Zebra Vulnerable to Denial of Service via Interrupted JSON-RPC Requests from Authenticated Clients](https://junglewise.ai/threats/cve-2026-41585-zebra-vulnerable-to-denial-of-service-via-interrupted-json-rpc) (medium, CVSS 3.1, published 18 Apr 2026) - [CVE-2026-41584: Zebra has rk Identity Point Panic in Transaction Verification](https://junglewise.ai/threats/cve-2026-41584-zebra-has-rk-identity-point-panic-in-transaction-verification) (critical, CVSS 3.1, published 18 Apr 2026) ## Most severe zebrad (crates.io) vulnerabilities - [CVE-2026-54496: Zcash Orchard Action circuit soundness vulnerability in halo2_gadgets](https://junglewise.ai/threats/cve-2026-54496-zcash-orchard-action-circuit-soundness-vulnerability-in-halo2) (critical, CVSS 9.3, published 17 Jul 2026) - [Zcash Zebra consensus divergence in SIGHASH_SINGLE handling](https://junglewise.ai/threats/zcash-zebra-consensus-divergence-in-sighash-single-handling-8969cdaa) (critical, CVSS 9.2, published 7 May 2026) - [CVE-2026-44497: Zcash Foundation Zebra consensus divergence in sighash handling](https://junglewise.ai/threats/cve-2026-44497-zcash-foundation-zebra-consensus-divergence-in-sighash-handling) (critical, CVSS 9.1, published 7 May 2026) - [CVE-2026-41583: Zcash Foundation Zebra consensus divergence in sighash handling](https://junglewise.ai/threats/cve-2026-41583-zcash-foundation-zebra-consensus-divergence-in-sighash-handling) (critical, CVSS 9.1, published 8 May 2026) - [CVE-2026-52735: Zcash Zebra consensus divergence via P2SH sigop undercount](https://junglewise.ai/threats/cve-2026-52735-zcash-zebra-consensus-divergence-via-p2sh-sigop-undercount) (critical, CVSS 4, published 18 Aug 2026) - [CVE-2026-41584: Zebra has rk Identity Point Panic in Transaction Verification](https://junglewise.ai/threats/cve-2026-41584-zebra-has-rk-identity-point-panic-in-transaction-verification) (critical, CVSS 3.1, published 18 Apr 2026) - [CVE-2026-34377: ZcashFoundation Zebra consensus split via invalid V5 authorization data](https://junglewise.ai/threats/cve-2026-34377-zcashfoundation-zebra-consensus-split-via-invalid-v5) (high, CVSS 8.1, published 31 Mar 2026) - [CVE-2026-40880: Zebra: Cached Mempool Verification Bypasses Consensus Rules for Ahead-of-Tip Blocks](https://junglewise.ai/threats/cve-2026-40880-zebra-cached-mempool-verification-bypasses-consensus-rules-for) (high, CVSS 8.1, published 21 Apr 2026) - [CVE-2026-34202: ZcashFoundation Zebra remote denial of service via crafted V5 transactions](https://junglewise.ai/threats/cve-2026-34202-zcashfoundation-zebra-remote-denial-of-service-via-crafted-v5) (high, CVSS 7.5, published 31 Mar 2026) - [CVE-2026-52829: ZcashFoundation Zebra assertion panic in address book mempool update](https://junglewise.ai/threats/cve-2026-52829-zcashfoundation-zebra-assertion-panic-in-address-book-mempool) (high, CVSS 7.5, published 18 Aug 2026) ## Vulnerabilities per week Nothing was published in the last eight weeks. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 10 | 1 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Other crates.io technologies - [surrealdb (crates.io)](https://junglewise.ai/threats/technologies/surrealdb): 83 vulnerabilities - [wasmtime (crates.io)](https://junglewise.ai/threats/technologies/wasmtime): 67 vulnerabilities - [deno (crates.io)](https://junglewise.ai/threats/technologies/deno): 39 vulnerabilities - [russh (crates.io)](https://junglewise.ai/threats/technologies/crates-io-russh): 26 vulnerabilities - [openssl-src (crates.io)](https://junglewise.ai/threats/technologies/openssl-src): 26 vulnerabilities - [openssl (crates.io)](https://junglewise.ai/threats/technologies/crates-io-openssl): 25 vulnerabilities - [rustfs (crates.io)](https://junglewise.ai/threats/technologies/rustfs): 25 vulnerabilities - [coreutils (crates.io)](https://junglewise.ai/threats/technologies/crates-io-coreutils): 21 vulnerabilities - [ckb (crates.io)](https://junglewise.ai/threats/technologies/ckb): 19 vulnerabilities - [apollo-router (crates.io)](https://junglewise.ai/threats/technologies/apollo-router): 13 vulnerabilities - [deepseek-tui (crates.io)](https://junglewise.ai/threats/technologies/deepseek-tui): 13 vulnerabilities - [diesel (crates.io)](https://junglewise.ai/threats/technologies/diesel): 13 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "zebrad (crates.io) vulnerabilities", https://junglewise.ai/threats/technologies/zebrad, 9 November 2026.