ZcashFoundation vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2026-109363 ZcashFoundation Zebra 6.4.0 before 6.4.2 parses version 6 transactions carrying a pre-NU6.3 consensus branch ID, but the size computation during UnminedTx constHigh 8.7 · Oct 12, 2026
• CVE-2026-104437 Zebra before 4.4.0 contains a consensus divergence vulnerability in V5 transparent signature verification, computing a ZIP-244 digest for SIGHASH_SINGLE inputs High 8.3 · Oct 2, 2026
• CVE-2026-104435 Zebra zebrad 4.4.0 and zebra-script 6.0.0 fail to enforce a ZIP-244 consensus rule, accepting V5 transparent inputs signed with SIGHASH_SINGLE that lack a correHigh 8.3 · Oct 2, 2026
• CVE-2026-104434 ZcashFoundation Zebra zebra-rpc before 8.0.0 and zebrad before 4.5.0 contain a reachable assertion in the z_listunifiedreceivers RPC handler, which calls expectHigh 7.1 · Oct 2, 2026
• CVE-2026-104431 Zebra before 6.0.0 contains a denial of service vulnerability that allows unauthenticated peers to stall Tokio workers by submitting mempool transactions requirHigh 8.7 · Oct 2, 2026
• CVE-2026-104430 Zebra zebrad 4.5.0 and zebra-script 7.0.0 count P2SH redeem script signature operations in legacy mode rather than zcashd's accurate P2SH mode, overcounting CHEHigh 8.7 · Oct 2, 2026
• CVE-2026-104427 Zebra before 6.1.0 contains an incomplete cleanup vulnerability in the state write task that allows remote unauthenticated peers to stall node synchronization bHigh 8.2 · Oct 2, 2026
• CVE-2026-104426 Zebra before 6.1.0 contains an inefficient algorithmic complexity vulnerability in remaining_transaction_value that clones the entire block-level spent-UTXO mapHigh 8.2 · Oct 2, 2026
• CVE-2026-104423 Zebra (zebrad) before 6.2.1 contains an asymmetric resource consumption vulnerability that allows unauthenticated peers to stall block verification by pushing VHigh 8.7 · Oct 2, 2026
• CVE-2026-104422 The block sync download path in Zebra (zebrad) before 6.3.0 reads a block's height from its unvalidated coinbase scriptSig and drops blocks that appear too far High 8.7 · Oct 2, 2026
• CVE-2026-52829 ZEBRA is a Zcash node written entirely in Rust.High 7.5 · Aug 18, 2026
• CVE-2026-52736 ZEBRA is a Zcash node written entirely in Rust.High 8.7 · Aug 18, 2026
• CVE-2026-52735 ZEBRA is a Zcash node written entirely in Rust.Critical 9.3 · Aug 18, 2026
• CVE-2026-54496 ZEBRA is a Zcash node written entirely in Rust.Critical 9.3 · Jul 17, 2026
• CVE-2026-44499 ZEBRA is a Zcash node written entirely in Rust.High 8.7 · May 8, 2026
• CVE-2026-44498 ZEBRA is a Zcash node written entirely in Rust.Critical 9.2 · May 8, 2026
• CVE-2026-44497 ZEBRA is a Zcash node written entirely in Rust.Critical 9.3 · May 8, 2026
• CVE-2026-41584 ZEBRA is a Zcash node written entirely in Rust.Critical 9.2 · May 8, 2026
• CVE-2026-41583 ZEBRA is a Zcash node written entirely in Rust.Critical 9.3 · May 8, 2026
• CVE-2026-40880 ZEBRA is a Zcash node written entirely in Rust.High 7.2 · Apr 21, 2026
• CVE-2026-34377 ZEBRA is a Zcash node written entirely in Rust.High 8.4 · Mar 31, 2026
• CVE-2026-34202 ZEBRA is a Zcash node written entirely in Rust.Critical 9.2 · Mar 31, 2026