CVE Feed

    Dashboard / CVE / CVE-2026-104434

    CVE-2026-104434

    ZcashFoundation Zebra zebra-rpc before 8.0.0 and zebrad before 4.5.0 contain a reachable assertion in the z_listunifiedreceivers RPC handler, which calls expect() on Sapling receiver parsing that fails for Unified Addresses carrying invalid Jubjub points. Authenticated RPC clients can submit such an address to abort the zebrad process, repeatably keeping the node offline.

    Published:Oct 2, 2026
    Last Modified:Oct 2, 2026
    EPS:Oct 2, 2026
    EPSS Score:
    CVSS Score:6.5

    Affected Products

    Vendor
    Zcashfoundation
    Product
    Zebra
    Vendor
    Zfnd
    Product
    Zebra

    Exploits

    No exploit reference

    Common Weakness Enumeration

    CWE-617 Reachable Assertion

    Common Attack Pattern Enumeration and Classification (CAPEC)

    No CAPEC recorded yet

    Related CVEs

    CVE-2026-109366 (CVSS 6.3) — Zebra before 6.4.0 contains an improper integrity validation vulnerability in the inbound gossip download path…
    CVE-2026-109365 (CVSS 6.3) — Zebra before 6.4.0 contains an uncontrolled resource consumption vulnerability that allows unauthenticated pee…
    CVE-2026-109364 (CVSS 6.9) — Zebra 2.3.0 before 6.4.0 contains a protection mechanism failure that allows unauthenticated peers to evade ba…
    CVE-2026-109363 (CVSS 8.7) — ZcashFoundation Zebra 6.4.0 before 6.4.2 parses version 6 transactions carrying a pre-NU6.3 consensus branch I…
    CVE-2026-104437 (CVSS 8.3) — Zebra before 4.4.0 contains a consensus divergence vulnerability in V5 transparent signature verification, com…
    CVE-2026-104436 (CVSS 6.3) — Zebra before 4.5.0 contains an uncontrolled resource consumption vulnerability that allows remote P2P peers to…
    CVE-2026-104435 (CVSS 8.3) — Zebra zebrad 4.4.0 and zebra-script 6.0.0 fail to enforce a ZIP-244 consensus rule, accepting V5 transparent i…
    CVE-2026-104432 (CVSS 6.9) — Zebra before 6.3.0 contains an improper exceptional condition check in ChainSync::obtain_tips that discards va…
    CVE-2026-104431 (CVSS 8.7) — Zebra before 6.0.0 contains a denial of service vulnerability that allows unauthenticated peers to stall Tokio…
    CVE-2026-104430 (CVSS 8.7) — Zebra zebrad 4.5.0 and zebra-script 7.0.0 count P2SH redeem script signature operations in legacy mode rather …

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High