CVE-2026-52829 ZcashFoundation CVE debrief

Who should care

Defenders responsible for ZEBRA node configurations and deployments should assess exposure and prioritize updates to prevent node termination by unauthenticated IPv4 peers. They should also verify node configurations and listener settings, and monitor for unusual node termination. This includes operators, platform administrators, vulnerability management teams, and security teams who need to ensure the security and integrity of Zebra nodes in their managed

Why it matters

CVE-2026-52829 allows unauthenticated IPv4 peers to terminate synced Zebra nodes. Defenders should prioritize updates to prevent node termination and verify node configurations.

• Termination of Zebra nodes by unauthenticated IPv4 peers
• Potential disruption of Zcash network operations
• Need for verification of node configurations and listener settings
• Priority for updating to version 4.5.0 or later

Technical summary

The vulnerability is caused by the handshake path canonicalizing an IPv4-mapped IPv6 PeerSocketAddr to plain IPv4 before storing it, while the mempool misbehavior path forwards the raw transient address, leading to an address mismatch assertion and termination of the Zebra node. This issue is fixed in version 4.5.0. The vulnerability allows unauthenticated IPv4 peers to terminate synced Zebra nodes. Defenders should prioritize updates to prevent node termination and verify node configurations. The issue arises from the address mismatch assertion in zebra-network/src/meta_addr.rs.

Defensive priority

Defenders should prioritize updating to version 4.5.0 or later to prevent termination of Zebra nodes by unauthenticated IPv4 peers.

Recommended defensive actions

• Update to version 4.5.0 or later
• Verify node configurations and listener settings
• Monitor for unusual node termination
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability is caused by the handshake path canonicalizing an IPv4-mapped IPv6 PeerSocketAddr to plain IPv4 before storing it, while the mempool misbehavior path forwards the raw transient address, leading to an address mismatch assertion and termination of the Zebra node.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.