CVE-2026-52829: ZEBRA Zcash Node DoS Vulnerability

CVE-2026-52829 Overview

CVE-2026-52829 affects Zebra, a Zcash node written entirely in Rust and maintained by the Zcash Foundation. Versions prior to 4.5.0 contain a reachable assertion [CWE-617] in the peer-to-peer handshake and mempool misbehavior path. An unauthenticated IPv4 peer can deterministically terminate a synced Zebra node running the default Linux dual-stack listener configuration. The attacker only needs to complete a P2P handshake and advertise an invalid mempool transaction to trigger the abort. The issue is fixed in version 4.5.0.

Critical Impact
Any unauthenticated network peer can remotely crash a Zebra Zcash node, disrupting Zcash network participation and validator availability.

Affected Products

Zebra Zcash node versions prior to 4.5.0
Deployments using the default Linux dual-stack (IPv4/IPv6) listener configuration
zebra-network crate handling IPv4-mapped IPv6 peer addresses

Discovery Timeline

2026-08-18 - CVE-2026-52829 published to NVD
2026-08-18 - Last updated in NVD database

Technical Details for CVE-2026-52829

Vulnerability Analysis

The vulnerability resides in Zebra's peer address handling logic within zebra-network/src/meta_addr.rs. Zebra's handshake path canonicalizes IPv4-mapped IPv6 addresses such as ::ffff:127.0.0.1 to their plain IPv4 form before storing them through MetaAddr::new_connected. However, the mempool misbehavior code path bypasses this canonicalization and forwards the raw transient address directly to MetaAddrChange::UpdateMisbehavior.

When apply_to_meta_addr compares the canonical address-book entry against the raw update address, the mismatch triggers an assertion designed to catch an "unexpected address" condition. Because Zebra is compiled with panic = abort, the assertion terminates the zebrad process rather than unwinding, producing a full denial-of-service condition against the node.

Root Cause

The root cause is inconsistent address normalization across two code paths that share state. The handshake path stores canonicalized IPv4 addresses in the address book, while the misbehavior reporting path submits non-canonicalized IPv4-mapped IPv6 addresses. This asymmetry violates an invariant enforced by an assertion, converting a benign format mismatch into a process abort.

Attack Vector

The attack is unauthenticated and network-reachable. An attacker connects to a Zebra node listening on a dual-stack socket, completes a standard P2P handshake using an IPv4-mapped IPv6 source address, and advertises an invalid mempool transaction. The subsequent misbehavior batch flush triggers the assertion mismatch and aborts zebrad.

text

// Source: https://github.com/ZcashFoundation/zebra/commit/1440b43ca7df59aca948090d45117557b217a6cd
// Version bump reflecting the fix in v4.5.0

 [[package]]
 name = "zebra-chain"
-version = "7.0.0"
+version = "8.0.0"
 dependencies = [
  "bech32",
  "bitflags 2.11.1",

Detection Methods for CVE-2026-52829

Indicators of Compromise

Unexpected zebrad process termination with an assertion failure referencing address mismatch in meta_addr.rs.
Repeated inbound P2P connections from IPv4-mapped IPv6 source addresses (for example, ::ffff:<ipv4>) shortly before crashes.
Log entries indicating mempool misbehavior events immediately preceding node exit.

Detection Strategies

Monitor zebrad exit codes and restart frequency; a pattern of abrupt exits correlated with peer traffic indicates exploitation.
Correlate inbound peer connection logs with subsequent node crashes to identify the offending source address.
Alert on repeated invalid-transaction submissions from single peers on the P2P port.

Monitoring Recommendations

Ship zebrad stdout/stderr and systemd journal entries to a centralized logging platform for assertion-failure detection.
Track network-layer connection metadata for the Zebra P2P listener, focusing on IPv6 source addresses that encode IPv4.
Establish baseline uptime metrics for Zcash validator nodes and alert on deviations.

How to Mitigate CVE-2026-52829

Immediate Actions Required

Upgrade Zebra to version 4.5.0 or later, which contains the address canonicalization fix.
Inventory all Zcash infrastructure running zebrad and confirm the deployed version.
Restrict inbound P2P connectivity to trusted peers where operationally feasible until the upgrade completes.

Patch Information

The fix is available in Zebra v4.5.0. See the GitHub Security Advisory GHSA-63wg-wjjj-7cp8, the GitHub Release v4.5.0, and the remediation commit for details. The patch aligns address canonicalization between the handshake and misbehavior paths so the assertion in apply_to_meta_addr is no longer reachable via crafted peer traffic.

Workarounds

Disable dual-stack listening by binding zebrad only to an IPv4 address, avoiding IPv4-mapped IPv6 peer connections.
Place the node behind a firewall or reverse proxy that filters or rewrites IPv6 source addresses.
Limit inbound peers to an allowlist of known-good addresses until the upgrade is deployed.

bash

# Upgrade Zebra to the patched release
git clone https://github.com/ZcashFoundation/zebra.git
cd zebra
git checkout v4.5.0
cargo build --release

# Optional: bind zebrad to IPv4 only to avoid dual-stack exposure
# In zebrad.toml
# [network]
# listen_addr = "0.0.0.0:8233"