These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
A vulnerability in ZEBRA, a Zcash node written in Rust, allows an unauthenticated IPv4 peer to terminate a synced Zebra node using the default Linux dual-stack listener configuration. This issue is fixed in version 4.5.0. The vulnerability arises from the handshake path canonicalizing an IPv4-mapped IPv6 PeerSocketAddr to plain IPv4 before storing it, while the mempool misbehavior path forwards the raw tr [truncated]
A vulnerability in ZEBRA, a Zcash node written in Rust, allows a malicious block producer to terminate zebrad by placing the same shielded transaction in a non-finalized parent block and its child. This issue arises from the Chain::push function in zebra-state/src/service/non_finalized_state/chain.rs, which originally inserted the transaction hash into tx_loc_by_hash and asserted uniqueness before updatin [truncated]
A consensus-valid block with a long chain of transparent self-spends can halt Zebra nodes prior to version 4.5.0. This issue is caused by a credit-first ordering in the finalized-state writer, which can make the intermediate per-address balance exceed MAX_MONEY. The issue is fixed in version 4.5.0. Defenders should assess exposure and prioritize updating to version 4.5.0 or later to prevent node halting. [truncated]
A vulnerability in ZEBRA, a Zcash node written in Rust, allows a malicious unauthenticated P2P peer to degrade synchronization without corrupting state by answering Zebra's outbound getblocks or FindBlocks request with a small two-hash inventory and then serving a syntactically valid block whose coinbase height is far above the local chain tip. The issue is fixed in version 4.5.0 and defenders should asse [truncated]
A remote unauthenticated P2P peer can stall a Zebra node by racing an invalid block body against the valid canonical body for the same block header hash. This issue is fixed in version 4.5.0. The vulnerability allows an attacker to mutate coinbase scriptSig authentication data while retaining the transaction identifiers, merkle root, and block header hash, causing the poisoned body to fail later commitmen [truncated]
A vulnerability in ZEBRA, a Zcash node written in Rust, allows it to accept blocks that zcashd rejects due to incorrect counting of signature operations in P2SH scripts. This can lead to a consensus chain split affecting network integrity and availability. The issue arises from the use of the pure-Rust script::Code::sig_op_count path, which stops counting at disabled opcodes, whereas zcashd continues coun [truncated]
A vulnerability in ZEBRA, a Zcash node written in Rust, allows an unauthenticated P2P peer to cause memory growth by retaining transactions after verification timeouts. This issue is fixed in version 4.5.0. The vulnerability could lead to denial-of-service (DoS) attacks through sustained traffic, causing monotonic memory growth until swap pressure degrades the node or the operating system terminates the z [truncated]
A natural or attacker-influenced chain fork in ZEBRA, a Zcash node written in Rust, can leave stale Sapling and Orchard note-commitment subtree roots in Zebra state. This issue is fixed in version 4.5.0. The vulnerability allows an attacker to potentially cause wallet synchronization failures or incorrect wallet state due to stale subtree roots. Defenders should assess exposure and prioritize updating to [truncated]
A vulnerability in ZEBRA, a Zcash node written in Rust, allows an unauthenticated P2P peer to monopolize all 25 MAX_INBOUND_CONCURRENCY slots in Zebra's inbound mempool download and verification pipeline. This issue is fixed in version 4.5.0. The vulnerability allows an attacker to advertise fake transaction identifiers and remain silent, causing honest peer transactions and local sendrawtransaction reque [truncated]
CVE-2026-52731 is a vulnerability in the ZEBRA Zcash node, which allows an authenticated attacker to terminate the node process by supplying a malformed LongPollId to an enabled Zebra RPC endpoint. The issue is fixed in version 4.5.0. This vulnerability impacts Zcash node availability and requires defenders to verify exposure and prioritize upgrading to version 4.5.0 or later. The vulnerability is caused [truncated]
