PT-2026-37131 · Zebra-Rpc+1 · Zebra-Rpc+1

Shieldedonly · Published 2026-04-18 · Updated 2026-05-08 · CVE-2026-41585

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H

Name of the Vulnerable Software and Affected Versions zebrad versions 2.2.0 through 4.3.0 zebra-rpc versions 1.0.0-beta.45 through 6.0.1

Description A flaw in the JSON-RPC HTTP middleware allows an authenticated RPC client to cause a node crash. The issue occurs when a client disconnects before the request body is fully received, such as by resetting the TCP connection mid-transfer. The node incorrectly treats the failure to read the HTTP request body as an unrecoverable error and aborts the process instead of returning an error response, resulting in a Denial of Service (DoS). This can be exploited by clients with valid RPC credentials or on nodes where cookie authentication is disabled and the RPC interface is exposed.

Recommendations Update zebrad to version 4.3.1. Update zebra-rpc to version 6.0.2. Ensure the RPC port is not exposed to untrusted networks and keep cookie authentication enabled.

Fix

Assertion Failure

Weakness Enumeration

CWE-248

CWE-617

Related Identifiers

CVE-2026-41585

GHSA-29X4-R6JV-FF4W

Affected Products

Zebra-Rpc

Zebrad

References · 5

• https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-29x4-r6jv-ff4w · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-29x4-r6jv-ff4w · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-41585 · Security Note
• https://github.com/ZcashFoundation/zebra · Note
• https://twitter.com/CVEnew/status/2052810983718936957 · Twitter Post