CVE-2026-41585 Details
Description
ZEBRA is a Zcash node written entirely in Rust. From zebrad versions 2.2.0 to before 4.3.1 and from zebra-rpc versions 1.0.0-beta.45 to before 6.0.2, a vulnerability in Zebra's JSON-RPC HTTP middleware allows an authenticated RPC client to cause a Zebra node to crash by disconnecting before the request body is fully received. The node treats the failure to read the HTTP request body as an unrecoverable error and aborts the process instead of returning an error response. This issue has been patched in zebrad version 4.3.1 and zebra-rpc version 6.0.2.
A denial-of-service vulnerability has been identified in ZEBRA, a Zcash node implementation in Rust. This issue affects zebrad versions 2.2.0 prior to 4.3.1 and zebra-rpc versions 1.0.0-beta.45 prior to 6.0.2. The vulnerability arises in Zebra's JSON-RPC HTTP middleware, where an authenticated RPC client can cause a Zebra node to crash by disconnecting before the entire request body is received. The node mistakenly interprets this interruption as a critical error, leading to an abrupt process termination instead of sending an error response. This flaw has been addressed in zebrad version 4.3.1 and zebra-rpc version 6.0.2.
Users are advised to upgrade to Zebra version 4.3.1 or later. If an immediate upgrade is not feasible, ensure that the RPC port is not exposed to untrusted networks and that cookie authentication remains enabled, as these measures can help mitigate the risk.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 8, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-29x4-r6jv-ff4w | [email protected] | MitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-248 | Uncaught Exception | [email protected] |
| CWE-617 | Reachable Assertion | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| zfnd zebra-rpc | >= 2.0.0, < 6.0.2 1.0.0 - 1.0.0 beta45 1.0.0 beta46 |
CPE
Remediation
| |
| zfnd zebrad | >= 2.2.0, < 4.3.1 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 8, 2026 | Initial Analysis | [email protected] |
| May 8, 2026 | New CVE Received | [email protected] |