CVE-2026-41584 json
ZEBRA: rk Identity Point Panic in Transaction Verification
published 2026-04-18 6 mo ago modified 2026-06-17 4 mo ago also GHSA-452v-w3gx-72wg , EUVD-2026-28654
- cvss
- 7.5
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.3%
- EPSS 0.3% chance of exploitation in 30 days, percentile 19%
- public exploits
- 0
- none known
Summary
ZEBRA is a Zcash node written entirely in Rust. Prior to zebrad version 4.3.1 and prior to zebra-chain version 6.0.2, Orchard transactions contain a rk field which is a randomized validating key and also an elliptic curve point. The Zcash specification allows the field to be the identity (a "zero" value), however, the orchard crate which is used to verify Orchard proofs would panic when fed a rk with the identity value. Thus an attacker could send a crafted transaction that would make a Zebra node crash. This issue has been patched in zebrad version 4.3.1 and zebra-chain version 6.0.2.
Patch / fix
- crates.io zebrad 4.3.1
- crates.io zebra-chain 6.0.2
- zfnd zebra-chain 6.0.2
- zfnd zebrad 4.3.1
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 6 mo ago
Exploit prediction
0.27% chance of exploitation in the next 30 days, higher than 19% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 9.2 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H |
| CNA | 4.0 | 9.2 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| NVD | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| GitHub | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| crates.io | zebrad | <4.3.1 |
4.3.1 |
| crates.io | zebra-chain | <6.0.2 |
6.0.2 |
Affected products
- ZcashFoundation zebra
Classification
- Weakness
-
- CWE-617 Reachable Assertion
References
-
github.com
/ZcashFoundation/zebra/security/advisories/GHSA-452v-w3gx-72wg
web, vendor-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2026-41584
advisory
-
github.com
/ZcashFoundation/zebra
package
Sources
- CVE List CVE-2026-41584
- GitHub Advisory GHSA-452v-w3gx-72wg
- NVD CVE-2026-41584
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.