# ZcashFoundation vulnerabilities Source: https://junglewise.ai/threats/vendors/zcashfoundation Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 9 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/vendors/zcashfoundation.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 19 vulnerabilities in ZcashFoundation: 0 in the last 7 days and 10 in the last 90 days, 4 of them critical and 0 exploited in the wild. The most recent, CVE-2026-104426, was published on 2 October 2026. Nothing in the last four weeks, down from 1 vulnerability in the four before. ## Counts - Last 7 days: 0 - Last 30 days: 0 - Last 90 days: 10 - All time: 19 (4 critical, 0 exploited in the wild) ## About ZcashFoundation Foundation supporting the Zcash privacy-focused cryptocurrency protocol and ecosystem. ## Latest ZcashFoundation vulnerabilities - [CVE-2026-104426: Zebra inefficient algorithmic complexity in block validation](https://junglewise.ai/threats/cve-2026-104426-zebra-before-6-1-0-contains-an-inefficient-algorithmic) (medium, CVSS 5.9, published 2 Oct 2026) - [CVE-2026-52829: ZcashFoundation Zebra assertion panic in address book mempool update](https://junglewise.ai/threats/cve-2026-52829-zcashfoundation-zebra-assertion-panic-in-address-book-mempool) (high, CVSS 7.5, published 18 Aug 2026) - [CVE-2026-52739: ZcashFoundation Zebra process abort via repeated shielded transactions](https://junglewise.ai/threats/cve-2026-52739-zcashfoundation-zebra-process-abort-via-repeated-shielded) (medium, CVSS 5.9, published 18 Aug 2026) - [CVE-2026-52738: ZcashFoundation Zebra denial of service via balance overflow in state writer](https://junglewise.ai/threats/cve-2026-52738-zcashfoundation-zebra-denial-of-service-via-balance-overflow-in) (medium, CVSS 4, published 18 Aug 2026) - [CVE-2026-52736: ZcashFoundation Zebra block suppression via same-header body poisoning](https://junglewise.ai/threats/cve-2026-52736-zcashfoundation-zebra-block-suppression-via-same-header-body) (high, CVSS 4, published 18 Aug 2026) - [CVE-2026-52735: Zcash Zebra consensus divergence via P2SH sigop undercount](https://junglewise.ai/threats/cve-2026-52735-zcash-zebra-consensus-divergence-via-p2sh-sigop-undercount) (critical, CVSS 4, published 18 Aug 2026) - [CVE-2026-52734: ZcashFoundation zebrad memory leak in mempool download pipeline](https://junglewise.ai/threats/cve-2026-52734-zcashfoundation-zebrad-memory-leak-in-mempool-download-pipeline) (medium, CVSS 5.3, published 18 Aug 2026) - [CVE-2026-52733: ZcashFoundation zebrad persistent state corruption in subtree roots](https://junglewise.ai/threats/cve-2026-52733-zcashfoundation-zebrad-persistent-state-corruption-in-subtree) (medium, CVSS 6.5, published 18 Aug 2026) - [CVE-2026-52732: ZcashFoundation zebrad denial of service in mempool inbound queue](https://junglewise.ai/threats/cve-2026-52732-zcashfoundation-zebrad-denial-of-service-in-mempool-inbound-queue) (medium, CVSS 5.3, published 18 Aug 2026) - [CVE-2026-52731: ZcashFoundation zebrad denial of service via non-ASCII LongPollId in getblocktemplate](https://junglewise.ai/threats/cve-2026-52731-zcashfoundation-zebrad-denial-of-service-via-non-ascii-longpollid) (medium, CVSS 6.5, published 18 Aug 2026) - [CVE-2026-54496: Zcash Orchard Action circuit soundness vulnerability in halo2_gadgets](https://junglewise.ai/threats/cve-2026-54496-zcash-orchard-action-circuit-soundness-vulnerability-in-halo2) (critical, CVSS 9.3, published 17 Jul 2026) - [Zcash Foundation Zebra resource exhaustion in P2P codec](https://junglewise.ai/threats/zcash-foundation-zebra-resource-exhaustion-in-p2p-codec-189d566f) (low, CVSS 3.7, published 2 Jul 2026) - [ZcashFoundation zebrad denial of service in z_listunifiedreceivers](https://junglewise.ai/threats/zcashfoundation-zebrad-denial-of-service-in-z-listunifiedreceivers-d7538689) (medium, CVSS 6.5, published 2 Jul 2026) - [Zcash Zebra CPU amplification in getblocks and getheaders handlers](https://junglewise.ai/threats/zcash-zebra-cpu-amplification-in-getblocks-and-getheaders-handlers-f019ca3b) (low, CVSS 3.7, published 2 Jul 2026) - [Zcash Zebra consensus divergence in SIGHASH_SINGLE handling](https://junglewise.ai/threats/zcash-zebra-consensus-divergence-in-sighash-single-handling-8969cdaa) (critical, CVSS 9.2, published 7 May 2026) - [CVE-2026-44497: Zcash Foundation Zebra consensus divergence in sighash handling](https://junglewise.ai/threats/cve-2026-44497-zcash-foundation-zebra-consensus-divergence-in-sighash-handling) (critical, CVSS 9.1, published 7 May 2026) - [CVE-2026-44498: Zcash Zebra consensus failure via sigop undercounting in block validator](https://junglewise.ai/threats/cve-2026-44498-zcash-zebra-consensus-failure-via-sigop-undercounting-in-block) (high, CVSS 7.5, published 7 May 2026) - [CVE-2026-34377: ZcashFoundation Zebra consensus split via invalid V5 authorization data](https://junglewise.ai/threats/cve-2026-34377-zcashfoundation-zebra-consensus-split-via-invalid-v5) (high, CVSS 8.1, published 31 Mar 2026) - [CVE-2026-34202: ZcashFoundation Zebra remote denial of service via crafted V5 transactions](https://junglewise.ai/threats/cve-2026-34202-zcashfoundation-zebra-remote-denial-of-service-via-crafted-v5) (high, CVSS 7.5, published 31 Mar 2026) ## Most severe ZcashFoundation vulnerabilities - [CVE-2026-54496: Zcash Orchard Action circuit soundness vulnerability in halo2_gadgets](https://junglewise.ai/threats/cve-2026-54496-zcash-orchard-action-circuit-soundness-vulnerability-in-halo2) (critical, CVSS 9.3, published 17 Jul 2026) - [Zcash Zebra consensus divergence in SIGHASH_SINGLE handling](https://junglewise.ai/threats/zcash-zebra-consensus-divergence-in-sighash-single-handling-8969cdaa) (critical, CVSS 9.2, published 7 May 2026) - [CVE-2026-44497: Zcash Foundation Zebra consensus divergence in sighash handling](https://junglewise.ai/threats/cve-2026-44497-zcash-foundation-zebra-consensus-divergence-in-sighash-handling) (critical, CVSS 9.1, published 7 May 2026) - [CVE-2026-52735: Zcash Zebra consensus divergence via P2SH sigop undercount](https://junglewise.ai/threats/cve-2026-52735-zcash-zebra-consensus-divergence-via-p2sh-sigop-undercount) (critical, CVSS 4, published 18 Aug 2026) - [CVE-2026-34377: ZcashFoundation Zebra consensus split via invalid V5 authorization data](https://junglewise.ai/threats/cve-2026-34377-zcashfoundation-zebra-consensus-split-via-invalid-v5) (high, CVSS 8.1, published 31 Mar 2026) - [CVE-2026-34202: ZcashFoundation Zebra remote denial of service via crafted V5 transactions](https://junglewise.ai/threats/cve-2026-34202-zcashfoundation-zebra-remote-denial-of-service-via-crafted-v5) (high, CVSS 7.5, published 31 Mar 2026) - [CVE-2026-52829: ZcashFoundation Zebra assertion panic in address book mempool update](https://junglewise.ai/threats/cve-2026-52829-zcashfoundation-zebra-assertion-panic-in-address-book-mempool) (high, CVSS 7.5, published 18 Aug 2026) - [CVE-2026-44498: Zcash Zebra consensus failure via sigop undercounting in block validator](https://junglewise.ai/threats/cve-2026-44498-zcash-zebra-consensus-failure-via-sigop-undercounting-in-block) (high, CVSS 7.5, published 7 May 2026) - [CVE-2026-52736: ZcashFoundation Zebra block suppression via same-header body poisoning](https://junglewise.ai/threats/cve-2026-52736-zcashfoundation-zebra-block-suppression-via-same-header-body) (high, CVSS 4, published 18 Aug 2026) - [CVE-2026-52731: ZcashFoundation zebrad denial of service via non-ASCII LongPollId in getblocktemplate](https://junglewise.ai/threats/cve-2026-52731-zcashfoundation-zebrad-denial-of-service-via-non-ascii-longpollid) (medium, CVSS 6.5, published 18 Aug 2026) ## Vulnerabilities per week Nothing in the last four weeks, down from 1 vulnerability in the four before. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 9 | 1 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 1 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "ZcashFoundation vulnerabilities", https://junglewise.ai/threats/vendors/zcashfoundation, 9 November 2026.