crates.io (Rust)

zebrad Security Analysis

zebrad has 19 known security vulnerabilities in crates.io (Rust). Upgrade to version 5.0.0 or later to resolve all known issues. Data sourced from OSV, enriched with EPSS exploit probability and CISA KEV.

19 Vulnerabilities

Low Immediate Risk

No actively exploited vulnerabilities detected. Monitor and update in your next maintenance window.

Recommended safe version: 5.0.0

Upgrading to 5.0.0 or later resolves all 19 known vulnerabilities in zebrad. Update Cargo.toml: zebrad = "5.0.0"

Is zebrad in your project?

Check if you're affected and upgrade to 5.0.0 to stay secure.

Start Free Scan Get Alerted When New CVEs Drop

Total

Critical

High

Medium

Low

Vulnerabilities

19 unique vulnerabilities — sorted by exploitation risk (KEV → EPSS → CVSS). Click a CVE/GHSA ID for full details.

CVE / GHSA	Severity	CVSS	EPSS	Summary	Affected	Fixed In
CVE-2026-52735 zebrad has consensus divergence via P2SH sigop undercount in pure-Rust disabled-opcode parser	CRITICAL	10.0	—	zebrad has consensus divergence via P2SH sigop undercount in pure-Rust disabled-opcode parser	All versions	4.5.0
CVE-2026-54496 Zebra: Missing copy constraint in halo2_gadgets variable-base scalar multiplication allows under-constrained base, breaking Orchard Action circuit soundness	CRITICAL	9.3	—	Zebra: Missing copy constraint in halo2_gadgets variable-base scalar multiplication allows under-constrained base, breaking Orchard Action circuit soundness	All versions	5.0.0
CVE-2026-44497 Zebra has Consensus Divergence in Transparent Sighash Hash-Type Handling due to Stale Buffer	CRITICAL	9.1	—	Zebra has Consensus Divergence in Transparent Sighash Hash-Type Handling due to Stale Buffer	All versions	4.4.0
CVE-2026-41583 Zebra Vulnerable to Consensus Divergence in Transparent Sighash Hash-Type Handling	CRITICAL	9.1	—	Zebra Vulnerable to Consensus Divergence in Transparent Sighash Hash-Type Handling	All versions	4.3.1
CVE-2026-34202 Zebra node crash — V5 transaction hash panic (P2P reachable)	CRITICAL	8.6	—	Zebra node crash — V5 transaction hash panic (P2P reachable)	All versions	4.3.0
GHSA-pvmv-cwg8-v6c8 Zebra v4.4.0 still accepts V5 SIGHASH_SINGLE without a corresponding output	CRITICAL	10.0	—	Zebra v4.4.0 still accepts V5 SIGHASH_SINGLE without a corresponding output	All versions	4.4.1
CVE-2026-41584 Zebra has rk Identity Point Panic in Transaction Verification	CRITICAL	7.5	—	Zebra has rk Identity Point Panic in Transaction Verification	All versions	4.3.1
CVE-2026-44498 Zebra's Block Validator Undercounts Coinbase and P2SH Sigops	CRITICAL	7.5	—	Zebra's Block Validator Undercounts Coinbase and P2SH Sigops	All versions	4.4.0
GHSA-cwfq-rfcr-8hmp Zebra's Transparent SIGHASH_SINGLE Handling Diverges from zcashd for Corresponding Outputs	CRITICAL	8.6	—	Zebra's Transparent SIGHASH_SINGLE Handling Diverges from zcashd for Corresponding Outputs	All versions	4.4.0
CVE-2026-40880 Zebra: Cached Mempool Verification Bypasses Consensus Rules for Ahead-of-Tip Blocks	HIGH	9.2	—	Zebra: Cached Mempool Verification Bypasses Consensus Rules for Ahead-of-Tip Blocks	All versions	4.3.1
CVE-2026-34377 Zebra has a Consensus Failure due to Improper Verification of V5 Transactions	HIGH	8.7	—	Zebra has a Consensus Failure due to Improper Verification of V5 Transactions	All versions	4.3.0
CVE-2026-52829 Zebra Address Book Aborted by IPv4-Mapped Mempool Misbehavior Update	HIGH	7.5	—	Zebra Address Book Aborted by IPv4-Mapped Mempool Misbehavior Update	All versions	4.5.0
CVE-2026-52736 Zebra has block suppression via NU5 same-header body poisoning of sent-hash cache	HIGH	7.5	—	Zebra has block suppression via NU5 same-header body poisoning of sent-hash cache	All versions	4.5.0
CVE-2026-44499 Zebra has Permanent Block Discovery Halt via Gossip Queue Saturation and Syncer Poisoning	HIGH	7.5	—	Zebra has Permanent Block Discovery Halt via Gossip Queue Saturation and Syncer Poisoning	All versions	4.4.0
CVE-2026-52733 zebrad has persistent on-disk corruption of Sapling/Orchard subtree roots after chain fork via pop_tip	MEDIUM	6.5	—	zebrad has persistent on-disk corruption of Sapling/Orchard subtree roots after chain fork via pop_tip	All versions	4.5.0
CVE-2026-52731 zebrad has full node denial of service via non-ASCII LongPollId in getblocktemplate	MEDIUM	6.5	—	zebrad has full node denial of service via non-ASCII LongPollId in getblocktemplate	All versions	4.5.0
CVE-2026-41585 Zebra Vulnerable to Denial of Service via Interrupted JSON-RPC Requests from Authenticated Clients	MEDIUM	6.5	—	Zebra Vulnerable to Denial of Service via Interrupted JSON-RPC Requests from Authenticated Clients	All versions	4.3.1
CVE-2026-52739 Zebra: Repeated Non-Finalized Shielded Transaction Aborts Zebra Before Duplicate-Nullifier Rejection	MEDIUM	5.9	—	Zebra: Repeated Non-Finalized Shielded Transaction Aborts Zebra Before Duplicate-Nullifier Rejection	All versions	4.5.0
CVE-2026-44500 Zebra Vulnerable to Allocation Amplification in Inbound Network Deserializers	MEDIUM	5.3	—	Zebra Vulnerable to Allocation Amplification in Inbound Network Deserializers	All versions	4.4.0

About This Data

Vulnerability data for zebrad is sourced from the Open Source Vulnerability (OSV) database, aggregating reports from GitHub Advisory Database, NIST NVD, and ecosystem-specific sources.

CVSS (Common Vulnerability Scoring System) scores reflect exploitability and impact. EPSS (Exploit Prediction Scoring System) scores indicate the probability of exploitation within the next 30 days. Vulnerabilities marked with are listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.