CVE-2026-52737Medium· 5.3▾ SunlitZEBRA is a Zcash node written entirely in Rust. Prior to 4.5.0, a malicious unauthenticated P2P peer can answer Zebra's outbound getblocks or FindBlocks request with a small two-hash inventory and then serve a syntactically valid block w…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 29.2 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Aug 19.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.2%
Last analysed / modified upstream
0.2% → 0.3%
ZEBRA is a Zcash node written entirely in Rust. Prior to 4.5.0, a malicious unauthenticated P2P peer can answer Zebra's outbound getblocks or FindBlocks request with a small two-hash inventory and then serve a syntactically valid block whose coinbase height is far above the local chain tip. In zebrad/src/components/sync/downloads.rs, BlockDownloadVerifyError::AboveLookaheadHeightLimit originally carried only the block height and hash, so handle_block_response could not attribute the failure to the advertising peer. The error then reached the restart-worthy default path in zebrad/src/components/sync.rs, cancelling all in-flight downloads from honest peers and imposing a 67-second sync restart delay on mainnet. Because the peer was neither scored nor disconnected, the peer could repeat the cycle indefinitely with minimal bandwidth and significantly degrade synchronization without corrupting state. This issue is fixed in version 4.5.0.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
zebra-consensus <= 6.0.0zebrad <= 4.4.1Patched in:
zebra-consensus 7.0.0zebrad 4.5.0Connected by shared product, vendor, weakness, or advisory.
CVE-2025-31356NoneInsufficient verification of data authenticity for some Intel(R) Trust Domain Extensions (Intel(R) TDX) within Ring 0: Hypervisor may allow an information disclosure
CVE-2026-33471Critical· 9.6nimiq-block has skip block quorum bypass via out-of-range BitSet indices & u16 truncation
CVE-2026-63127High· 8.2RMCP is an official Rust SDK for the Model Context Protocol
CVE-2026-45057Medium· 4.9matrix-sdk-ui provides GUI-centric utilities on top of matrix-rust-sdk
CVE-2026-54496Critical· 9.3Zebra: Missing copy constraint in halo2_gadgets variable-base scalar multiplication allows under-constrained base, breaking Orchard Action circuit soundness
CVE-2026-103402High· 8.8Session Smart Router and Session Smart Conductor: Lack of integrity verification in cache files causes arbitrary code execution and privilege escalation