{"id":"CVE-2026-52829","revision":"b720c5fae253466a8f9cbb19fd307684","records":[{"revision":"b720c5fae253466a8f9cbb19fd307684","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-52829","aliases":[],"title":"ZEBRA: IPv4-Mapped Mempool Misbehavior Update Aborts Zebra Address Book","description":"ZEBRA is a Zcash node written entirely in Rust. Prior to 4.5.0, an unauthenticated IPv4 peer can deterministically terminate a synced Zebra node using the default Linux dual-stack listener configuration. The handshake path canonicalized an IPv4-mapped IPv6 PeerSocketAddr such as ::ffff:127.0.0.1 to plain IPv4 before storing it through MetaAddr::new_connected, but the mempool misbehavior path forwarded the raw transient address to MetaAddrChange::UpdateMisbehavior. In zebra-network/src/meta_addr.rs, apply_to_meta_addr then compared the canonical address-book entry with the raw update address and reached its unexpected address mismatch assertion. After the misbehavior batch flush, panic equals abort terminated zebrad; the peer only needed to complete a P2P handshake and advertise an invalid mempool transaction. This issue is fixed in version 4.5.0.","state":0,"publishedAt":"2026-08-18T19:27:57.318+00:00","modifiedAt":"2026-08-18T19:44:56.318+00:00","affected":[{"ecosystem":"Vendor product","name":"zebra","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"ZcashFoundation\",\n                    \"product\": \"zebra\",\n                    \"versions\": [\n                        {\n                            \"version\": \"< 4.5.0\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":7.5,"severity":"HIGH"}],"references":["https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-63wg-wjjj-7cp8","https://github.com/ZcashFoundation/zebra/commit/1440b43ca7df59aca948090d45117557b217a6cd","https://github.com/ZcashFoundation/zebra/releases/tag/v4.5.0"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-52829","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-52829","identifiers":["CVE-2026-52829"]},"retained":false,"historicalAffected":[]}],"coverage":[]}