Security: ZcashFoundation/zebra
Security Advisories
View known security vulnerabilities and report new vulnerabilities privately to maintainers.
-
Unauthenticated peer can crash zebrad by sending a version 6 transaction whose consensus branch predates NU6.3GHSA-h5rr-8pqv-grp9 published
Sep 25, 2026 by mpguerraHigh -
Peer bans are keyed per exact IP address and are ineffective against IPv6 peersGHSA-jhpp-8h75-7pv5 published
Sep 28, 2026 by mpguerraModerate -
Same-hash block body forces full proof verification with no peer penaltyGHSA-3c94-hf7p-g5mf published
Sep 28, 2026 by mpguerraModerate -
Coinbase scriptSig rewrite drops a gossiped block on the inbound path without penalizing the supplying peerGHSA-4f6v-mj46-gxg3 published
Sep 28, 2026 by mpguerraLow -
Far-ahead FindBlocks hashes cause Zebra to ban honest peers that serve requested blocksGHSA-qhr3-cvch-5fh2 published
Aug 11, 2026 by conradoplgModerate -
Invalid gossiped blocks bypass peer misbehavior scoringGHSA-8hh2-hrf2-cqf4 published
Aug 11, 2026 by conradoplgModerate -
Poisoned blocks can delay download of valid blocks (SentHashes lockout on the KnownBlock path)GHSA-x93j-mj2f-q338 published
Jul 22, 2026 by mpguerraModerate -
Coinbase scriptSig rewrite drops a required block during sync without penalizing the supplying peerGHSA-g95h-hw6g-pvgv published
Aug 11, 2026 by conradoplgHigh -
Uncapped shielded verification cost lets peer-pushed V6 transactions stall block verificationGHSA-2p4c-3q4q-p463 published
Aug 17, 2026 by mpguerraHigh -
Block template omits header and transaction-count size, allowing oversized invalid blocks and wasted mining workGHSA-95m2-vx53-v2jw published
Jul 17, 2026 by mpguerraLow