PT-2026-33599 · Zcash · Zebrad+2

Zk-Nd3R

·

Published

2026-04-18

·

Updated

2026-04-21

·

CVE-2026-40881

CVSS v3.1

7.5

High

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Name of the Vulnerable Software and Affected Versions zebrad versions prior to 4.3.0 zebra-network versions prior to 5.0.1 Zebra versions prior to 4.3.1
Description An issue exists during the deserialization of 'addr' or 'addrv2' messages containing vectors of addresses. The software would fully deserialize these messages up to a maximum length derived from the 2 MiB message size limit (over 233,000 entries), which significantly exceeds the specification limit of 1,000 messages. Because the memory for the larger vector was allocated before the limit check occurred, an attacker could trigger out-of-memory aborts by sending multiple such messages over different connections, leading to a denial of service. This occurs within the read addr/addrv2 functions in codec.rs using the zcash deserialize() trait method, which relied on T::max allocation() for the upper bound.
Recommendations Update zebrad to version 4.3.0 or later. Update zebra-network to version 5.0.1 or later. Update Zebra to version 4.3.1 or later.

Exploit

Fix

DoS

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

CVE-2026-40881
GHSA-XR93-PCQ3-PXF8

Affected Products

Zebra
Zebra-Network
Zebrad