Executive brief
zebrad vulnerable to getblocks/getheaders locator CPU amplification via uncapped vector length
Affected products
- crates.io zebrad
- crates.io zebra-chain
Junglewise Threat Intelligence
zebrad vulnerable to getblocks/getheaders locator CPU amplification via uncapped vector length
Severity: low · CVSS 3.1 · Published 2026-07-02
Technologies: zebrad (crates.io), zebra-chain (crates.io). Vendors: crates.io.
Related threats
- ZEBRA is a Zcash node written entirely in Rust. Prior to 4.5.0, an unauthenticated IPv4 peer can deterministically terminate a synced Zebra
- ZEBRA is a Zcash node written entirely in Rust. Prior to 4.5.0, a malicious block producer can terminate zebrad by placing the same shielded
- ZEBRA is a Zcash node written entirely in Rust. Prior to 4.5.0, a consensus-valid block containing a long chain of transparent self-spends t
- ZEBRA is a Zcash node written entirely in Rust. Prior to 4.5.0, a malicious unauthenticated P2P peer can answer Zebra's outbound getblocks o
- ZEBRA is a Zcash node written entirely in Rust. Prior to 4.5.0, a remote unauthenticated P2P peer can stall a Zebra node by racing an invali