Most recent entries from all

EUVD-2026-309233

2026-10-05T01:05:40.824689+00:00

EUVD-2026-309233

fkie_cve-2026-44500

2026-10-05T01:05:40.824739+00:00

ZEBRA is a Zcash node written entirely in Rust. Prior to zebrad version 4.4.0, prior to zebra-chain version 7.0.0, and prior to zebra-network version 6.0.0, several inbound deserialization paths in Zebra allocated buffers sized against generic transport or block-size ceilings before the tighter protocol or consensus limits were enforced. An unauthenticated or post-handshake peer could therefore force the node to preallocate and parse for orders of magnitude more data than the protocol intended, across headers messages, equihash solutions in block headers, Sapling spend vectors in V5/V4 transactions, and coinbase script bytes in blocks. This issue has been patched in zebrad version 4.4.0, zebra-chain version 7.0.0, and zebra-network version 6.0.0.

GHSA-438q-jx8f-cccv — Zebra Vulnerable to Allocation Amplification in Inbound Network Deserializers

2026-10-05T01:05:40.824791+00:00

Affected: crates.io: zebra-network, crates.io: zebrad, crates.io: zebra-chain

# CVE-2026-44500: Allocation Amplification in Inbound Network Deserializers

## Summary

Several inbound deserialization paths in Zebra allocated buffers sized against generic transport or block-size ceilings before the tighter protocol or consensus limits were enforced. An unauthenticated or post-handshake peer could therefore force the node to preallocate and parse for orders of magnitude more data than the protocol intended, across `headers` messages, equihash solutions in block headers, Sapling spend vectors in V5/V4 transactions, and coinbase script bytes in blocks.

## Severity

**Moderate** - This is a Denial-of-Service Vulnerability that could allow a malicious peer to amplify per-message memory and parse cost on Zebra nodes, with effects amplified by multi-peer fan-in.

Each individual case is bounded by the 2 MiB transport ceiling or the block-size cap, so no single message causes unbounded allocation, but the cumulative gap between intended and actual limits is significant.

## Affected Versions

All Zebra versions prior to 4.4.0.

## Description

Zebra's network codec uses `TrustedPreallocate` and generic `Vec` deserialization to bound inbound message parsing. In several places the bound used at the deserializer was the generic transport or block-size ceiling rather than the tighter protocol or consensus rule that applies to the field, so allocation happened first and the real limit was only enforced afterwards. Four such cases were identified:

- **`headers` mes…