GHSA-29x4-r6jv-ff4w CVE-2026-41585
Zebra Vulnerable to Denial of Service via Interrupted JSON-RPC Requests from Authenticated Clients
- Severity
- 0.0 / 10
- Medium · CVSS 4.0
- Exploit chance (EPSS)
- 0.26%
- Chance of exploitation in the next 30 days. Higher than 17.44% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Fix
- Available
- 2 packages have a fixed version
Description
A vulnerability in Zebra's JSON-RPC HTTP middleware allows an authenticated RPC client to cause a Zebra node to crash by disconnecting before the request body is fully received. The node treats the failure to read the HTTP request body as an unrecoverable error and aborts the process instead of returning an error response.
Severity
Moderate - This is a Denial of Service (DoS) that requires a client capable of passing Zebra's cookie authentication, which is enabled by default.
Affected Versions
zebrad: versions from 2.2.0 up to (but not including) 4.3.1zebra-rpc: versions from 1.0.0-beta.45 up to (but not including) 6.0.2
Description
Zebra's JSON-RPC HTTP middleware treated a failure to read the incoming HTTP request body as an unrecoverable error, aborting the process rather than returning an error response. A client that disconnected after sending only part of a request body, for example, by resetting the TCP connection mid-transfer, was sufficient to trigger the crash. The vulnerability could be exploited only by authenticated RPC clients. Nodes running the shipped defaults, with RPC bound to localhost and cookie authentication on, were not vulnerable.
Impact
Denial of Service
- Attack Vector: Network, authenticated (requires a valid RPC cookie when cookie authentication is enabled).
- Effect: Immediate crash of the Zebra node.
- Scope: Any node whose RPC interface is reachable by a client with valid credentials, or any node with cookie authentication disabled and an exposed RPC interface.
Fixed Versions
This issue is fixed in Zebra 4.3.1 (crate zebra-rpc 6.0.2).
The fix propagates failures to read the HTTP request body as ordinary error responses, so Zebra now rejects truncated or interrupted requests rather than crashing.
Mitigation
Users should upgrade to Zebra 4.3.1 or later.
If an immediate upgrade is not possible, users should ensure their RPC port is not exposed to untrusted networks and that cookie authentication remains enabled (the default).
References
Credits
Thanks to shieldedonly who discovered this issue and reported it via our coordinated disclosure process.
Affected versions
crates.io
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
zebra-rpc crates.io → 6.0.2
- cargo
cargo update -p zebra-rpc --precise 6.0.2
zebrad crates.io → 4.3.1
- cargo
cargo update -p zebrad --precise 4.3.1
Severity breakdown
CVSS 4.0 0.0
CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H
- Attack vector
- Network
- Attack complexity
- Low
- Attack requirements
- Present
- Privileges required
- High
- User interaction
- None
- Confidentiality (vulnerable system)
- None
- Integrity (vulnerable system)
- None
- Availability (vulnerable system)
- High
- Confidentiality (subsequent systems)
- None
- Integrity (subsequent systems)
- None
- Availability (subsequent systems)
- High
CVSS 3.1 6.5
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- Low
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Weakness
CWE-248: Uncaught Exception
An exception is thrown from a function, but it is not caught.
CWE-617: Reachable Assertion
The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.
How to prevent it
- Implementation: Make sensitive open/close operation non reachable by directly user-controlled data (e.g. open/close resources)
- Implementation: Perform input validation on user data.
References
Advisories
Packages
Other links
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-ww9q-8r59-xv46 Zebra: Missing copy constraint in halo2_gadgets variable-base scalar multiplication allows under-constrained base, breaking Orchard Action circuit soundness | Critical | Also affects zebrad |
| GHSA-63wg-wjjj-7cp8 Zebra Address Book Aborted by IPv4-Mapped Mempool Misbehavior Update | High | Also affects zebrad |
| GHSA-65jj-fmw8-468q zebrad has unbounded memory leak in mempool download pipeline via timeout path cancel_handles retention | Medium | Also affects zebrad |
| GHSA-2gf8-q9rr-jq3h zebrad has persistent on-disk corruption of Sapling/Orchard subtree roots after chain fork via pop_tip | Medium | Also affects zebrad |
| GHSA-hhm7-qrv5-h4r6 Zebra: Repeated Non-Finalized Shielded Transaction Aborts Zebra Before Duplicate-Nullifier Rejection | Medium | Also affects zebrad |
| GHSA-w834-cf6p-9m9w Zebra: Finalized address balance credit-first overflow on consensus-valid blocks | Medium | Also affects zebrad |
| GHSA-gvjc-3w7c-92jx Zebra has sync restart poisoning from single unauthenticated peer via above-lookahead block | Medium | Also affects zebrad |
| GHSA-gf9r-m956-97qx zebrad has consensus divergence via P2SH sigop undercount in pure-Rust disabled-opcode parser | Critical | Also affects zebrad |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor