crates.io Package Vulnerabilities
Vulnerabilities associated with zebra-consensus.
Packages
Clear package- surrealdb52 vulnerabilities
- wasmtime39 vulnerabilities
- deno37 vulnerabilities
- zebrad27 vulnerabilities
- openssl-src26 vulnerabilities
- ckb22 vulnerabilities
- coreutils21 vulnerabilities
- openssl18 vulnerabilities
- rusqlite16 vulnerabilities
- russh15 vulnerabilities
- apollo-router13 vulnerabilities
- rustfs13 vulnerabilities
- tough10 vulnerabilities
- cargo8 vulnerabilities
- gix8 vulnerabilities
- surrealdb-core8 vulnerabilities
- gitoxide7 vulnerabilities
- hyper7 vulnerabilities
- pyo37 vulnerabilities
- routinator7 vulnerabilities
- vaultwarden7 vulnerabilities
- Simple-Wayland-HotKey-Daemon6 vulnerabilities
- astral-tokio-tar6 vulnerabilities
- cranelift-codegen6 vulnerabilities
- deno_runtime6 vulnerabilities
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
Zebra has sync restart poisoning from single unauthenticated peer via above-lookahead block### Am I affected You are affected if: 1. You run `zebrad` up to and including `v4.4.1`. 2. Your node accepts inbound P2P connections and is syncing or catching up to the chain tip. ### Summary A malicious peer can answer Zebra's outbound `getblocks`/`FindBlocks` request with a small two-hash inventory, then serve a syntactically valid block whose coinbase height is far above the victim's local tip. The `AboveLookaheadHeightLimit` error in the sync download pipeline triggers a global sync re… CWE-345Jul 2, 2026 | CVSS-v3.1 | EPSS- | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX | |
CVE-2026-40880HIGH | Zebra: Cached Mempool Verification Bypasses Consensus Rules for Ahead-of-Tip BlocksZEBRA is a Zcash node written entirely in Rust. Prior to zebrad version 4.3.1 and zebra-consensus version 5.0.2, a logic error in Zebra's transaction verification cache could allow a malicious miner to induce a consensus split. By carefully submitting a transaction that is valid for height H+1 but invalid for H+2 and then mining that transaction in a block at height H+2, a miner could cause vulnerable Zebra nodes to accept an invalid block, leading to a consensus split from the rest of the Zcash… CWE-1025Apr 21, 2026 | CVSS7.2v4.0 | EPSS0.261% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-34377HIGH | Zebra has a Consensus Failure due to Improper Verification of V5 TransactionsZEBRA is a Zcash node written entirely in Rust. Prior to zebrad version 4.3.0 and zebra-consensus version 5.0.1, a logic error in Zebra's transaction verification cache could allow a malicious miner to induce a consensus split. By matching a valid transaction's txid while providing invalid authorization data, a miner could cause vulnerable Zebra nodes to accept an invalid block, leading to a consensus split from the rest of the Zcash network. This would not allow invalid transactions to be accep… CWE-347Mar 31, 2026 | CVSS8.4v4.0 | EPSS0.255% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |