Vulnerability · Published May 8, 2026 · Assigned by GitHub_M

CVE-2026-44499ZEBRA: Permanent Block Discovery Halt via Gossip Queue Saturation and Syncer Poisoning

High 8.7

In plain English

A high-severity resource allocation without limits in zebra from ZcashFoundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 29% of all known vulnerabilities).

Severity (CVSS 4.0)8.7High

Exploit odds (30 days)0.4%top 71.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

ZEBRA is a Zcash node written entirely in Rust. Prior to version 4.4.0, a composite denial-of-service vulnerability in Zebra's block discovery pipeline allows an unauthenticated remote attacker to permanently halt all new block discovery on a targeted node. The attack exploits three independent weaknesses in the gossip, syncer, and download subsystems — all exercisable from a single TCP connection — to create a monotonically growing block deficit that never self-heals. This issue has been patched in version 4.4.0.

Affected products (as reported)

Vendor	Product	Versions
ZcashFoundation	zebra	< 4.4.0

Weakness: CWE-770 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References

https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-h9hm-m2xj-4rq9 x_refsource_CONFIRM