GHSA-452V-W3GX-72WG: GHSA-452v-w3gx-72wg: Remote Denial of Service via Identity Point Panic in Zebra Zcash Node

#security #cve #cybersecurity #ghsa

GHSA-452v-w3gx-72wg: Remote Denial of Service via Identity Point Panic in Zebra Zcash Node

Vulnerability ID: GHSA-452V-W3GX-72WG
CVSS Score: 8.7
Published: 2026-04-18

The Zebra Zcash node implementation is vulnerable to a critical remote denial-of-service attack due to a logic error in Orchard transaction verification. An unhandled exception occurs when processing the randomized validating key (rk) if it is set to the Pallas curve identity point.

TL;DR

An unauthenticated remote attacker can crash a vulnerable Zebra node by broadcasting a crafted Orchard transaction where the rk field is the identity point. This triggers an .unwrap() panic in the underlying orchard crate, leading to immediate process termination.

Technical Details

CWE ID: CWE-248
Attack Vector: Network
CVSS 4.0: 8.7
Impact: Denial of Service
Exploit Status: none
KEV Status: Not Listed

Affected Systems

Zebra (zebrad)
Zebra (zebra-chain)
Zcash network nodes
Zebra: < 4.3.1 (Fixed in: 4.3.1)

Mitigation Strategies

Upgrade all Zebra nodes to version 4.3.1 or later.
Monitor process logs for panics related to the orchard crate or circuits.rs.
Adhere to the updated Zcash protocol specification regarding the rejection of identity rk values.

Remediation Steps:

Stop the running zebrad service.
Download or compile Zebra version 4.3.1.
Restart the zebrad service with the updated binary.
Verify that the node resumes syncing and processing transactions correctly.

References

Read the full report for GHSA-452V-W3GX-72WG on our website for more details including interactive diagrams and full exploit analysis.

DEV Community