Denial of Service in ZcashFoundation Zebra RPC Product
CVE-2026-104434

7.1HIGH

Key Information:

Vendor

Zcashfoundation

Status
Zebra
Vendor
CVE Published:
2 October 2026

What is CVE-2026-104434?

A vulnerability exists in ZcashFoundation's Zebra and Zebrad, where maliciously crafted Unified Addresses with invalid Jubjub points can exploit the z_listunifiedreceivers RPC handler. Authenticated RPC clients can cause the zebrad process to abort by submitting these addresses, preventing the node from operating correctly and leading to potential service disruptions. This issue highlights the need for robust input validation to enhance the resilience of the service against such attacks.

Affected Version(s)

zebra 0 < 8.0.0

zebra 0 < 4.5.0

zebra 8.0.0

References

https://github.com/ZcashFoundation/zebra/security/advisor...
vendor-advisory
https://www.vulncheck.com/advisories/zebra-before-8.0.0-d...
third-party-advisory

CVSS V4

Score:
7.1
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

robustfengbin
mpguerra
upbqdn
.