Remote Vulnerability in Zcash Node by ZEBRA Before Version 4.5.0
CVE-2026-52829
7.5HIGH
What is CVE-2026-52829?
ZEBRA, a Zcash node written in Rust, has a vulnerability that allows an unauthenticated IPv4 peer to cause termination of a synced node. This occurs when the default Linux dual-stack listener configuration is used before version 4.5.0. During the peer-to-peer handshake, an IPv4-mapped IPv6 PeerSocketAddr is incorrectly canonicalized to plain IPv4, leading to a mismatch in address verification. A malicious peer can exploit this by advertising an invalid mempool transaction, resulting in the panic and subsequent abort of the Zcash node. The vulnerability has been addressed and fixed in version 4.5.0.
Affected Version(s)
zebra < 4.5.0