Vulnerabilities

CVE-2026-54496

github.com/zcash/halo2
github.com/zcash/librustzcash
github.com/zcash/orchard
github.com/zcash/zcash
github.com/zcashfoundation/zebra

Missing copy constraint in halo2_gadgets variable-base scalar multiplication allows under-constrained base, breaking Orchard Action circuit soundness 17 Jul

Fix available
Severity - 9.3 (Critical)