PT-2026-37130 · Orchard+2 · Orchard+2

Alex Sol + 1 · Published 2026-04-18 · Updated 2026-05-08 · CVE-2026-41584

Positive Technologies (AI Summary)

CVSS v4.0

9.2

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H

Name of the Vulnerable Software and Affected Versions zebrad versions prior to 4.3.1 zebra-chain versions prior to 6.0.2

Description Orchard transactions include an rk field, which serves as a randomized validating key and an elliptic curve point. While the Zcash specification permits this field to be the identity (a zero value), the orchard crate used for verifying Orchard proofs triggers a panic when processing an rk with the identity value. Specifically, the issue occurs in the circuits.rs file of the orchard crate, where the system attempts to retrieve coordinates of the rk value and calls unwrap() on the results. An attacker can exploit this by submitting a crafted transaction containing an identity rk, causing the node to crash and resulting in a Denial of Service.

Recommendations Update zebrad to version 4.3.1 or later. Update zebra-chain to version 6.0.2 or later.

Fix

Assertion Failure

Weakness Enumeration

CWE-617

Related Identifiers

CVE-2026-41584

GHSA-452V-W3GX-72WG

Affected Products

Orchard

Zebra-Chain

Zebrad

References · 5

• https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-452v-w3gx-72wg · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-452v-w3gx-72wg · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-41584 · Security Note
• https://github.com/ZcashFoundation/zebra · Note
• https://twitter.com/CVEnew/status/2052810984712999159 · Twitter Post