zebrad (crates.io)
Advisories
27
Latest version
—
License
—
OpenSSF Scorecard
—
How to fix
Upgrading to 5.0.0 or later clears every advisory below that has a fix.
Upgrade commands
cargo
cargo update -p zebrad --precise 5.0.0Known vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| GHSA-ww9q-8r59-xv46 Zebra: Missing copy constraint in halo2_gadgets variable-base scalar multiplication allows under-constrained base, breaking Orchard Action circuit soundness |
Critical EPSS 0.32% |
< 5.0.0 | 5.0.0 |
| GHSA-63wg-wjjj-7cp8 Zebra Address Book Aborted by IPv4-Mapped Mempool Misbehavior Update |
High EPSS 0.61% |
< 4.5.0 | 4.5.0 |
| GHSA-65jj-fmw8-468q zebrad has unbounded memory leak in mempool download pipeline via timeout path cancel_handles retention |
Medium EPSS 0.51% |
< 4.5.0 | 4.5.0 |
| GHSA-2gf8-q9rr-jq3h zebrad has persistent on-disk corruption of Sapling/Orchard subtree roots after chain fork via pop_tip |
Medium EPSS 0.44% |
< 4.5.0 | 4.5.0 |
| GHSA-hhm7-qrv5-h4r6 Zebra: Repeated Non-Finalized Shielded Transaction Aborts Zebra Before Duplicate-Nullifier Rejection |
Medium EPSS 0.52% |
< 4.5.0 | 4.5.0 |
| GHSA-w834-cf6p-9m9w Zebra: Finalized address balance credit-first overflow on consensus-valid blocks |
Medium EPSS 0.51% |
< 4.5.0 | 4.5.0 |
| GHSA-gvjc-3w7c-92jx Zebra has sync restart poisoning from single unauthenticated peer via above-lookahead block |
Medium EPSS 0.26% |
< 4.5.0 | 4.5.0 |
| GHSA-gf9r-m956-97qx zebrad has consensus divergence via P2SH sigop undercount in pure-Rust disabled-opcode parser |
Critical EPSS 0.51% |
< 4.5.0 | 4.5.0 |
| GHSA-4m69-67m6-prqp Zebra has block suppression via NU5 same-header body poisoning of sent-hash cache |
High EPSS 0.61% |
< 4.5.0 | 4.5.0 |
| GHSA-h72h-ppcx-998p Zebra has pre-handshake buffer capacity reservation based on attacker-claimed body length |
Low | < 4.5.0 | 4.5.0 |
| GHSA-4fc2-h7jh-287c zebrad has mempool transaction admission denial via single-peer inbound queue saturation |
Medium EPSS 0.51% |
< 4.5.0 | 4.5.0 |
| GHSA-c8w6-x74f-vmg3 zebrad vulnerable to full node denial of service via crafted Sapling receiver in z_listunifiedreceivers |
High EPSS 0.31% |
< 4.5.0 | 4.5.0 |
| GHSA-443g-gwgp-49x4 zebrad vulnerable to getblocks/getheaders locator CPU amplification via uncapped vector length |
Medium EPSS 0.27% |
< 4.5.0 | 4.5.0 |
| GHSA-qv2r-v3mx-f4pf zebrad has full node denial of service via non-ASCII LongPollId in getblocktemplate |
Medium EPSS 0.53% |
< 4.5.0 | 4.5.0 |
| GHSA-pvmv-cwg8-v6c8 Zebra v4.4.0 still accepts V5 SIGHASH_SINGLE without a corresponding output |
High EPSS 0.21% |
< 4.4.1 | 4.4.1 |
| GHSA-h9hm-m2xj-4rq9 Zebra has Permanent Block Discovery Halt via Gossip Queue Saturation and Syncer Poisoning |
High EPSS 0.35% |
< 4.4.0 | 4.4.0 |
| GHSA-cwfq-rfcr-8hmp Zebra's Transparent SIGHASH_SINGLE Handling Diverges from zcashd for Corresponding Outputs |
High EPSS 0.25% |
< 4.4.0 | 4.4.0 |
| GHSA-gq4h-3grw-2rhv Zebra has Consensus Divergence in Transparent Sighash Hash-Type Handling due to Stale Buffer |
Critical EPSS 0.19% |
< 4.4.0 | 4.4.0 |
| GHSA-438q-jx8f-cccv Zebra Vulnerable to Allocation Amplification in Inbound Network Deserializers |
Medium EPSS 0.36% |
< 4.4.0 | 4.4.0 |
| GHSA-jv4h-j224-23cc Zebra's Block Validator Undercounts Coinbase and P2SH Sigops |
High EPSS 0.28% |
< 4.4.0 | 4.4.0 |
| GHSA-8m29-fpq5-89jj Zebra Vulnerable to Consensus Divergence in Transparent Sighash Hash-Type Handling |
Critical EPSS 0.28% |
< 4.3.1 | 4.3.1 |
| GHSA-29x4-r6jv-ff4w Zebra Vulnerable to Denial of Service via Interrupted JSON-RPC Requests from Authenticated Clients |
Medium EPSS 0.26% |
>= 2.2.0, < 4.3.1 | 4.3.1 |
| GHSA-452v-w3gx-72wg Zebra has rk Identity Point Panic in Transaction Verification |
High EPSS 0.27% |
< 4.3.1 | 4.3.1 |
| GHSA-xr93-pcq3-pxf8 Zebra: addr/addrv2 Deserialization Resource Exhaustion |
High EPSS 0.26% |
< 4.3.1 | 4.3.1 |
| GHSA-xvj8-ph7x-65gf Zebra: Cached Mempool Verification Bypasses Consensus Rules for Ahead-of-Tip Blocks |
High EPSS 0.26% |
< 4.3.1 | 4.3.1 |
| GHSA-3vmh-33xr-9cqh Zebra has a Consensus Failure due to Improper Verification of V5 Transactions |
High EPSS 0.26% |
< 4.3.0 | 4.3.0 |
| GHSA-qp6f-w4r3-h8wg Zebra node crash — V5 transaction hash panic (P2P reachable) |
High EPSS 0.79% |
< 4.3.0 | 4.3.0 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor