Denial of Service Flaw in Zebra RPC of Zcash Foundation's Software
CVE-2026-104428

6.9MEDIUM

Key Information:

Vendor

Zcashfoundation

Status
Zebra
Vendor
CVE Published:
2 October 2026

What is CVE-2026-104428?

The getblock RPC method in the Zcash Foundation's Zebra node, prior to version 11.0.0, contains a vulnerability that allows remote unauthenticated attackers to exploit it. Specifically, when verbosity level 2 is requested for a side-chain block, the method encounters a panic due to an integer conversion issue. This flaw results in the node potentially entering a continuous crash loop, making it susceptible to denial of service attacks. Attackers can trigger this malfunction directly or through lightwalletd, leading to service disruption.

Affected Version(s)

zebra 0 < 11.0.0

zebra 11.0.0

References

https://github.com/ZcashFoundation/zebra/security/advisor...
vendor-advisory
https://www.vulncheck.com/advisories/zebra-before-11.0.0-...
third-party-advisory

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

mpguerra
defuse
oxarbitrage
upbqdn
.