CVE-2026-40881 Details
Description
ZEBRA is a Zcash node written entirely in Rust. Prior to zebrad version 4.3.0 and zebra-network version 5.0.1, when deserializing addr or addrv2 messages, which contain vectors of addresses, Zebra would fully deserialize them up to a maximum length (over 233,000) that was derived from the 2 MiB message size limit. This is much larger than the actual limit of 1,000 messages from the specification. Zebra would eventually check that limit but, at that point, the memory for the larger vector was already allocated. An attacker could cause out-of-memory aborts in Zebra by sending multiple such messages over different connections. This vulnerability is fixed in zebrad version 4.3.0 and zebra-network version 5.0.1.
A denial-of-service vulnerability has been identified in the Zebra network and Zebrad applications, both prior to their respective patched versions. This issue arises from the deserialization of 'addr' and 'addrv2' messages, which contain vectors of addresses. Zebra incorrectly allowed these messages to be deserialized up to a maximum length derived from a 2 MiB message size limit, leading to excessive memory allocation. Although Zebra eventually checked the message length against the specification limit of 1,000 messages, this verification occurred only after the memory for the larger vectors had already been allocated. As a result, an attacker could exploit this vulnerability by sending multiple such messages over different connections, causing the Zebra node to run out of memory and crash.
Users should upgrade to Zebra version 4.3.1 or later. There are no known workarounds for this issue.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 21, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-xr93-pcq3-pxf8 | CISA-ADP | Vendor Advisory |
| https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-xr93-pcq3-pxf8 | [email protected] | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-770 | Allocation of Resources Without Limits or Throttling | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| zfnd zebra-network | < 5.0.1 |
CPE
Remediation
| |
| zfnd zebrad | < 4.3.1 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 27, 2026 | Initial Analysis | [email protected] |
| Apr 21, 2026 | CVE Modified | CISA-ADP |
| Apr 21, 2026 | New CVE Received | [email protected] |