zebra
- Software type
- Other
- Total vulnerabilities (90 days)
- 32
- Products & ServicesProducts & Services
- SolutionsSolutions
- PricingPricing
- CompanyCompany
- ResourcesResources
en
en
A short verification protects source data and prevents automated AI requests.
Verifying...
As of 11/05/2026, zebra recorded 32 security vulnerabilities in the last 90 days, of which 13 are rated High or Critical. None of these vulnerabilities is actively exploited (KEV) according to CISA's catalog. CyStack recommends that organizations and individual users apply patches as soon as possible.
CyStack does not yet have sufficient official-source data to identify the latest version of zebra and determine which vulnerabilities affect that version.
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
CVE-2026-123560Zebra before 7.0.0 Sync Denial of Service via Forged Checkpoint Block BodyCVE-2026-123559Zebra before 7.0.0 Denial of Service via Quadratic Sighash ComputationCVE-2026-123558Zebra before 7.0.0 Checkpoint Sync Denial of Service via Cancelled Verifier RewindCVE-2026-123557Zebra zebrad before 7.0.0 Reachable Assertion DoS via Peer DisconnectionCVE-2026-123556Zebra 4.5.0 before 7.0.0 Honest Peer Ban via Mempool Lock-Time Scoring| Vulnerability | Exploitation status | Fix | Published | Severity |
|---|---|---|---|---|
CVE-2026-123560Zebra before 7.0.0 Sync Denial of Service via Forged Checkpoint Block Body | Exploitation statusNot confirmed | FixYes |
| SeverityHigh |
CVE-2026-123559Zebra before 7.0.0 Denial of Service via Quadratic Sighash Computation | Exploitation statusNot confirmed | FixYes | Published11/08/2026 | SeverityHigh |
|---|
CVE-2026-123558Zebra before 7.0.0 Checkpoint Sync Denial of Service via Cancelled Verifier Rewind | Exploitation statusNot confirmed | FixYes | Published11/08/2026 | SeverityHigh |
|---|
CVE-2026-123557Zebra zebrad before 7.0.0 Reachable Assertion DoS via Peer Disconnection | Exploitation statusNot confirmed | FixYes | Published11/08/2026 | SeverityHigh |
|---|
CVE-2026-123556Zebra 4.5.0 before 7.0.0 Honest Peer Ban via Mempool Lock-Time Scoring | Exploitation statusNot confirmed | FixYes | Published11/08/2026 | SeverityMedium |
|---|
CVE-2026-123555Zebra 2.3.0 before 7.0.0 Denial of Service via Unscored Script Verification Failures | Exploitation statusNot confirmed | FixYes | Published11/08/2026 | SeverityHigh |
|---|
CVE-2026-123554Zebra zebrad 6.4.0 before 7.0.0 Denial of Service via Mempool Coinbase-Maturity Check | Exploitation statusNot confirmed | FixYes | Published11/08/2026 | SeverityHigh |
|---|
CVE-2026-109366Zebra before 6.4.0 Gossiped Block Drop via Forged Coinbase scriptSig Height | Exploitation statusActively exploited | FixYes | Published10/12/2026 | SeverityMedium |
|---|
CVE-2026-109365Zebra before 6.4.0 Denial of Service via Same-Hash Forged Block Bodies | Exploitation statusNot exploited | FixYes | Published10/12/2026 | SeverityMedium |
|---|
CVE-2026-109364Zebra 2.3.0 before 6.4.0 Peer Ban Bypass via Exact-IP Keying | Exploitation statusNot exploited | FixYes | Published10/12/2026 | SeverityMedium |
|---|
CVE-2026-109363Zebra 6.4.0 before 6.4.2 Denial of Service via Malformed v6 Transaction | Exploitation statusNot exploited | FixYes | Published10/12/2026 | SeverityHigh |
|---|
CVE-2026-104437Zebra before 4.4.0 Consensus Split via SIGHASH_SINGLE Missing-Output Handling | Exploitation statusActively exploited | FixYes | Published10/02/2026 | SeverityHigh |
|---|
CVE-2026-104436Zebra before 4.5.0 CPU Amplification via Uncapped getblocks/getheaders Locator Length | Exploitation statusNot exploited | FixYes | Published10/02/2026 | SeverityMedium |
|---|
CVE-2026-104435Zebra 4.4.0 Consensus Divergence via V5 SIGHASH_SINGLE Without Output | Exploitation statusNot exploited | FixYes | Published10/02/2026 | SeverityHigh |
|---|
CVE-2026-104434Zebra before 8.0.0 Denial of Service via z_listunifiedreceivers RPC | Exploitation statusNot exploited | FixYes | Published10/02/2026 | SeverityHigh |
|---|
CVE-2026-104432Zebra before 6.3.0 False Readiness via Discarded One-Hash FindBlocks Response | Exploitation statusNot exploited | FixYes | Published10/02/2026 | SeverityMedium |
|---|
CVE-2026-104431Zebra before 6.0.0 Denial of Service via Synchronous Script FFI Verification | Exploitation statusNot exploited | FixYes | Published10/02/2026 | SeverityHigh |
|---|
CVE-2026-104430Zebra 4.5.0 Consensus Split via P2SH Sigop Overcount | Exploitation statusNot exploited | FixYes | Published10/02/2026 | SeverityHigh |
|---|
CVE-2026-104429Zebra before 6.0.0-rc.0 Per-Peer Mempool Admission Bypass via P2P tx Messages | Exploitation statusNot exploited | FixYes | Published10/02/2026 | SeverityMedium |
|---|
CVE-2026-104428Zebra before 11.0.0 Denial of Service via getblock Verbosity 2 | Exploitation statusNot exploited | FixYes | Published10/02/2026 | SeverityMedium |
|---|
CVE-2026-104427Zebra before 6.1.0 Chain Stall via Stale parent_error_map Entry | Exploitation statusNot exploited | FixYes | Published10/02/2026 | SeverityHigh |
|---|
CVE-2026-104426Zebra before 6.1.0 Quadratic Complexity DoS via Block Transparent Value Check | Exploitation statusNot exploited | FixYes | Published10/02/2026 | SeverityHigh |
|---|
CVE-2026-104425Zebra before 6.1.0 Batch-Verification Poisoning DoS via Unattributed Pushed Transactions | Exploitation statusNot exploited | FixYes | Published10/02/2026 | SeverityMedium |
|---|
CVE-2026-104424Zebra before 6.1.0 Incorrect Block Size Calculation in getblocktemplate | Exploitation statusNot exploited | FixYes | Published10/02/2026 | SeverityMedium |
|---|
CVE-2026-104423Zebra before 6.2.1 Denial of Service via Uncapped V6 Shielded Proof Verification | Exploitation statusNot exploited | FixYes | Published10/02/2026 | SeverityHigh |
|---|
CVE-2026-104422Zebra before 6.3.0 Block Sync Denial of Service via Coinbase scriptSig Rewrite | Exploitation statusNot exploited | FixYes | Published10/02/2026 | SeverityHigh |
|---|
CVE-2026-104421Zebra before 6.2.1 Block Download Denial of Service via KnownBlock SentHashes Lockout | Exploitation statusNot exploited | FixYes | Published10/02/2026 | SeverityMedium |
|---|
CVE-2026-104420Zebra before 6.3.0 Peer Misbehavior Ban Bypass via Gossiped Blocks | Exploitation statusNot exploited | FixYes | Published10/02/2026 | SeverityMedium |
|---|
CVE-2026-104419Zebra before 6.3.0 Honest Peer Banning via Far-Ahead FindBlocks Hashes | Exploitation statusNot exploited | FixYes | Published10/02/2026 | SeverityMedium |
|---|
CVE-2026-52829ZEBRA: IPv4-Mapped Mempool Misbehavior Update Aborts Zebra Address Book | Exploitation statusNot exploited | FixYes | Published08/18/2026 | SeverityHigh |
|---|
CVE-2026-52739ZEBRA: Repeated Non-Finalized Shielded Transaction Aborts Zebra Before Duplicate-Nullifier Rejection | Exploitation statusNot exploited | FixYes | Published08/18/2026 | SeverityMedium |
|---|
CVE-2026-52738ZEBRA: Finalized address balance credit-first overflow on consensus-valid blocks | Exploitation statusNot exploited | FixYes | Published08/18/2026 | SeverityMedium |
|---|
CVE-2026-52737ZEBRA: Sync restart poisoning from single unauthenticated peer via above-lookahead block | Exploitation statusNot exploited | FixYes | Published08/18/2026 | SeverityMedium |
|---|
CVE-2026-52736ZEBRA: Block suppression via NU5 same-header body poisoning of sent-hash cache | Exploitation statusNot exploited | FixYes | Published08/18/2026 | SeverityHigh |
|---|
CVE-2026-52735ZEBRA: Consensus divergence via P2SH sigop undercount in pure-Rust disabled-opcode parser | Exploitation statusNot exploited | FixYes | Published08/18/2026 | SeverityCritical |
|---|
CVE-2026-52734ZEBRA: Unbounded memory leak in mempool download pipeline via timeout path cancel_handles retention | Exploitation statusNot exploited | FixYes | Published08/18/2026 | SeverityMedium |
|---|
CVE-2026-52733ZEBRA: Persistent on-disk corruption of Sapling/Orchard subtree roots after chain fork via pop_tip | Exploitation statusNot exploited | FixYes | Published08/18/2026 | SeverityMedium |
|---|
CVE-2026-52732ZEBRA: Mempool transaction admission denial via single-peer inbound queue saturation | Exploitation statusActively exploited | FixYes | Published08/18/2026 | SeverityMedium |
|---|
CVE-2026-52731ZEBRA: Full node denial of service via non-ASCII LongPollId in getblocktemplate | Exploitation statusNot exploited | FixYes | Published08/18/2026 | SeverityMedium |
|---|
CVE-2026-54496Missing copy constraint in halo2_gadgets variable-base scalar multiplication allows under-constrained base, breaking Orchard Action circuit soundness | Exploitation statusNot exploited | FixYes | Published07/17/2026 | SeverityCritical |
|---|
CVE-2026-44500ZEBRA: Allocation Amplification in Inbound Network Deserializers | Exploitation statusNot exploited | FixYes | Published05/08/2026 | SeverityMedium |
|---|
CVE-2026-44499ZEBRA: Permanent Block Discovery Halt via Gossip Queue Saturation and Syncer Poisoning | Exploitation statusNot exploited | FixYes | Published05/08/2026 | SeverityHigh |
|---|
CVE-2026-44498ZEBRA: Block Validator Undercounts Coinbase and P2SH Sigops | Exploitation statusNot exploited | FixYes | Published05/08/2026 | SeverityCritical |
|---|
CVE-2026-44497ZEBRA: Consensus Divergence in Transparent Sighash Hash-Type Handling due to Stale Buffer | Exploitation statusNot exploited | FixYes | Published05/08/2026 | SeverityCritical |
|---|
CVE-2026-41585ZEBRA: Denial of Service via Interrupted JSON-RPC Requests from Authenticated Clients | Exploitation statusNot exploited | FixYes | Published05/08/2026 | SeverityMedium |
|---|
CVE-2026-41584ZEBRA: rk Identity Point Panic in Transaction Verification | Exploitation statusNot exploited | FixYes | Published05/08/2026 | SeverityCritical |
|---|
CVE-2026-41583ZEBRA: Consensus Divergence in Transparent Sighash Hash-Type Handling | Exploitation statusNot exploited | FixYes | Published05/08/2026 | SeverityCritical |
|---|
CVE-2026-34377Zebra has a Consensus Failure due to Improper Verification of V5 Transactions | Exploitation statusNot exploited | FixYes | Published03/31/2026 | SeverityHigh |
|---|
CVE-2026-34202Zebra node crash — V5 transaction hash panic (P2P reachable) | Exploitation statusNot exploited | FixYes | Published03/31/2026 | SeverityCritical |
|---|
42 Results | Page 1 of 1