CVE-2026-41584

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-41584
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-41584.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-41584
Aliases
Published
2026-05-08T15:05:06.070Z
Modified
2026-07-15T01:48:49.833364115Z
Severity
  • 9.2 (Critical) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H CVSS Calculator
Summary
ZEBRA: rk Identity Point Panic in Transaction Verification
Details

ZEBRA is a Zcash node written entirely in Rust. Prior to zebrad version 4.3.1 and prior to zebra-chain version 6.0.2, Orchard transactions contain a rk field which is a randomized validating key and also an elliptic curve point. The Zcash specification allows the field to be the identity (a "zero" value), however, the orchard crate which is used to verify Orchard proofs would panic when fed a rk with the identity value. Thus an attacker could send a crafted transaction that would make a Zebra node crash. This issue has been patched in zebrad version 4.3.1 and zebra-chain version 6.0.2.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/41xxx/CVE-2026-41584.json",
    "cwe_ids": [
        "CWE-617"
    ],
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": "zebra-chain < 6.0.2"
                },
                {
                    "last_affected": "zebra-chain < 6.0.2"
                }
            ],
            "source": "AFFECTED_FIELD"
        }
    ],
    "cna_assigner": "GitHub_M"
}
References

Affected packages

Git / github.com/zcashfoundation/zebra

Affected ranges

Type
GIT
Repo
https://github.com/zcashfoundation/zebra
Events
Introduced
aba329d6dca884f6d42bb4d36bda0010a071c2fc
Last affected
aba329d6dca884f6d42bb4d36bda0010a071c2fc
Database specific 
{
    "extracted_events": [
        {
            "introduced": "zebrad < 4.3.1"
        },
        {
            "last_affected": "zebrad < 4.3.1"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

4.*
4.3.1
v4.*
v4.3.1
zebrad < 4.*
zebrad < 4.3.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-41584.json"