Security: ZcashFoundation/zebra
Security Advisories
View known security vulnerabilities and report new vulnerabilities privately to maintainers.
-
Far-ahead FindBlocks hashes cause Zebra to ban honest peers that serve requested blocksGHSA-qhr3-cvch-5fh2 published
Aug 11, 2026 by conradoplgModerate -
Invalid gossiped blocks bypass peer misbehavior scoringGHSA-8hh2-hrf2-cqf4 published
Aug 11, 2026 by conradoplgModerate -
Poisoned blocks can delay download of valid blocks (SentHashes lockout on the KnownBlock path)GHSA-x93j-mj2f-q338 published
Jul 22, 2026 by mpguerraModerate -
Coinbase scriptSig rewrite drops a required block during sync without penalizing the supplying peerGHSA-g95h-hw6g-pvgv published
Aug 11, 2026 by conradoplgHigh -
Uncapped shielded verification cost lets peer-pushed V6 transactions stall block verificationGHSA-2p4c-3q4q-p463 published
Aug 17, 2026 by mpguerraHigh -
Block template omits header and transaction-count size, allowing oversized invalid blocks and wasted mining workGHSA-95m2-vx53-v2jw published
Jul 17, 2026 by mpguerraLow -
Unattributed pushed-transaction verification failures allow sustained batch-verification poisoning of block processingGHSA-g7c4-2w6c-cr3r published
Jul 17, 2026 by mpguerraModerate -
Quadratic transparent value check in block contextual verificationGHSA-4g24-549m-hp75 published
Jul 17, 2026 by mpguerraModerate -
Potential Chain Stall via stale `parent_error_map`GHSA-8gxx-hc65-vv82 published
Jul 17, 2026 by mpguerraModerate -
getblock verbosity 2 on a side-chain block panics the node via negative-confirmations u32 conversionGHSA-x6v8-c2xp-928m published
Jul 3, 2026 by mpguerraModerate