CVE-2026-54496 Zebra: Missing copy constraint in halo2_gadgets variable-base scalar multiplication allows under-constrained base, breaking Orchard Action circuit soundness

What is CVE-2026-54496?

CVE-2026-54496 is a critical vulnerability in ZcashFoundation halo2_gadgets, published on 17 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

ZEBRA is a Zcash node written entirely in Rust. Prior to zebrad 5.0.0, halo2_gadgets 0.5.0, orchard 0.14.0, zcash_primitives 0.28.0, and zcashd 6.20.0, the variable-base scalar multiplication gadget in halo2_gadgets/src/ecc/chip/mul/incomplete.rs used assign_advice() for the base point without a copy constraint tying it to the actual base, allowing a malicious prover to produce a valid proof for an Orchard Action with an under-constrained base point and bypass the diversified-address-integrity check that binds pk_d, g_d, ivk, the nullifier (nf), and the spend validating key (ak) to the note being spent. This issue is fixed in zebrad 5.0.0, halo2_gadgets 0.5.0, orchard 0.14.0, zcash_primitives 0.28.0, and zcashd 6.20.0.

Weakness: CWE-345

Which versions are affected by CVE-2026-54496?

8 open source packages ship an affected version, including halo2_gadgets, orchard and zcash_primitives.

How do I fix CVE-2026-54496?

Upgrade halo2_gadgets to 0.5.0 or later.

Is CVE-2026-54496 being exploited?

There is no known exploitation of CVE-2026-54496 in the wild and no public exploit code.

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-ww9q-8r59-xv46.