CVE-2026-41584 ZEBRA: rk Identity Point Panic in Transaction Verification

What is CVE-2026-41584?

CVE-2026-41584 is a critical denial of service vulnerability in ZcashFoundation zebra, published on 8 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

ZEBRA is a Zcash node written entirely in Rust. Prior to zebrad version 4.3.1 and prior to zebra-chain version 6.0.2, Orchard transactions contain a rk field which is a randomized validating key and also an elliptic curve point. The Zcash specification allows the field to be the identity (a "zero" value), however, the orchard crate which is used to verify Orchard proofs would panic when fed a rk with the identity value. Thus an attacker could send a crafted transaction that would make a Zebra node crash. This issue has been patched in zebrad version 4.3.1 and zebra-chain version 6.0.2.

Weakness: CWE-617

Which versions are affected by CVE-2026-41584?

4 open source packages ship an affected version, including zebra-chain and zebrad. It affects 2 products.

Products include Zfnd Zebra-Chain, Zfnd Zebrad.

How do I fix CVE-2026-41584?

Upgrade zebra-chain to 6.0.2 or later.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2026-41584 being exploited?

There is no known exploitation of CVE-2026-41584 in the wild and no public exploit code.

Other vulnerabilities in ZcashFoundation zebra

• CVE-2026-44500 ZEBRA: Allocation Amplification in Inbound Network Deserializers Medium 5.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-452v-w3gx-72wg.