Vulnerability · Published May 8, 2026 · Assigned by GitHub_M

CVE-2026-41584ZEBRA: rk Identity Point Panic in Transaction Verification

Critical 9.2

In plain English

A critical-severity security flaw in zebra from ZcashFoundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 19% of all known vulnerabilities).

Severity (CVSS 4.0)9.2Critical

Exploit odds (30 days)0.3%top 81.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

ZEBRA is a Zcash node written entirely in Rust. Prior to zebrad version 4.3.1 and prior to zebra-chain version 6.0.2, Orchard transactions contain a rk field which is a randomized validating key and also an elliptic curve point. The Zcash specification allows the field to be the identity (a "zero" value), however, the orchard crate which is used to verify Orchard proofs would panic when fed a rk with the identity value. Thus an attacker could send a crafted transaction that would make a Zebra node crash. This issue has been patched in zebrad version 4.3.1 and zebra-chain version 6.0.2.

Affected products (as reported)

Vendor	Product	Versions
ZcashFoundation	zebra	zebra-chain < 6.0.2zebrad < 4.3.1

Weakness: CWE-617 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H

References

https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-452v-w3gx-72wg x_refsource_CONFIRM