These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
Zebra before 6.4.0 contains an improper integrity validation vulnerability in the inbound gossip download path that allows unauthenticated peers to force dropping of new blocks without penalty. Attackers can serve a real block with a coinbase scriptSig rewritten to height 1, which keeps the ZIP-244 block hash, triggering a behind-tip drop before consensus validation and delaying tip discovery for mining backends.
A vulnerability in Zebra before 6.4.0 allows unauthenticated peers to cause a denial of service by serving forged block bodies with valid header hashes, leading to wasted proof verification and stalled sync for 67 seconds. This issue affects Zebra instances, potentially stalling them for an extended period. Defenders should assess exposure and prioritize patching to version 6.4.0 or later. The vulnerabili [truncated]
A protection mechanism failure in Zebra 2.3.0 before 6.4.0 allows unauthenticated peers to evade bans due to exact IP address keying for bans and misbehavior scores. Attackers can reconnect from fresh IPv6 addresses in their /64 allocation or flush the 20,000-entry FIFO ban list to restore access for banned peers. This vulnerability affects Zebra instances, particularly those with public-facing deployment [truncated]
CVE-2026-109363 is a high-severity vulnerability in ZcashFoundation's Zebra software versions 6.4.0 before 6.4.2. An unauthenticated peer can send a single malformed v6 transaction to cause a denial-of-service (DoS) by crashing the node, which can be repeated after each restart. The vulnerability is caused by the Zebra software's incorrect handling of version 6 transactions with a pre-NU6.3 consensus bran [truncated]
A vulnerability in ZEBRA, a Zcash node written in Rust, allows an unauthenticated IPv4 peer to terminate a synced Zebra node using the default Linux dual-stack listener configuration. This issue is fixed in version 4.5.0. The vulnerability arises from the handshake path canonicalizing an IPv4-mapped IPv6 PeerSocketAddr to plain IPv4 before storing it, while the mempool misbehavior path forwards the raw tr [truncated]
A vulnerability in ZEBRA, a Zcash node written in Rust, allows a malicious block producer to terminate zebrad by placing the same shielded transaction in a non-finalized parent block and its child. This issue arises from the Chain::push function in zebra-state/src/service/non_finalized_state/chain.rs, which originally inserted the transaction hash into tx_loc_by_hash and asserted uniqueness before updatin [truncated]
A consensus-valid block with a long chain of transparent self-spends can halt Zebra nodes prior to version 4.5.0. This issue is caused by a credit-first ordering in the finalized-state writer, which can make the intermediate per-address balance exceed MAX_MONEY. The issue is fixed in version 4.5.0. Defenders should assess exposure and prioritize updating to version 4.5.0 or later to prevent node halting. [truncated]
A vulnerability in ZEBRA, a Zcash node written in Rust, allows a malicious unauthenticated P2P peer to degrade synchronization without corrupting state by answering Zebra's outbound getblocks or FindBlocks request with a small two-hash inventory and then serving a syntactically valid block whose coinbase height is far above the local chain tip. The issue is fixed in version 4.5.0 and defenders should asse [truncated]
A remote unauthenticated P2P peer can stall a Zebra node by racing an invalid block body against the valid canonical body for the same block header hash. This issue is fixed in version 4.5.0. The vulnerability allows an attacker to mutate coinbase scriptSig authentication data while retaining the transaction identifiers, merkle root, and block header hash, causing the poisoned body to fail later commitmen [truncated]
A vulnerability in ZEBRA, a Zcash node written in Rust, allows it to accept blocks that zcashd rejects due to incorrect counting of signature operations in P2SH scripts. This can lead to a consensus chain split affecting network integrity and availability. The issue arises from the use of the pure-Rust script::Code::sig_op_count path, which stops counting at disabled opcodes, whereas zcashd continues coun [truncated]
A vulnerability in ZEBRA, a Zcash node written in Rust, allows an unauthenticated P2P peer to cause memory growth by retaining transactions after verification timeouts. This issue is fixed in version 4.5.0. The vulnerability could lead to denial-of-service (DoS) attacks through sustained traffic, causing monotonic memory growth until swap pressure degrades the node or the operating system terminates the z [truncated]
A natural or attacker-influenced chain fork in ZEBRA, a Zcash node written in Rust, can leave stale Sapling and Orchard note-commitment subtree roots in Zebra state. This issue is fixed in version 4.5.0. The vulnerability allows an attacker to potentially cause wallet synchronization failures or incorrect wallet state due to stale subtree roots. Defenders should assess exposure and prioritize updating to [truncated]
A vulnerability in ZEBRA, a Zcash node written in Rust, allows an unauthenticated P2P peer to monopolize all 25 MAX_INBOUND_CONCURRENCY slots in Zebra's inbound mempool download and verification pipeline. This issue is fixed in version 4.5.0. The vulnerability allows an attacker to advertise fake transaction identifiers and remain silent, causing honest peer transactions and local sendrawtransaction reque [truncated]
CVE-2026-52731 is a vulnerability in the ZEBRA Zcash node, which allows an authenticated attacker to terminate the node process by supplying a malformed LongPollId to an enabled Zebra RPC endpoint. The issue is fixed in version 4.5.0. This vulnerability impacts Zcash node availability and requires defenders to verify exposure and prioritize upgrading to version 4.5.0 or later. The vulnerability is caused [truncated]
