{"id":"EUVD-2026-24266","enisaUuid":"09f926aa-7af7-3f9a-865c-c4eb62256ed8","description":"ZEBRA is a Zcash node written entirely in Rust. Prior to zebrad version 4.3.1 and zebra-consensus version 5.0.2, a logic error in Zebra\u0027s transaction verification cache could allow a malicious miner to induce a consensus split. By carefully submitting a transaction that is valid for height H+1 but invalid for H+2 and then mining that transaction in a block at height H+2, a miner could cause vulnerable Zebra nodes to accept an invalid block, leading to a consensus split from the rest of the Zcash network. This vulnerability is fixed in zebrad version 4.3.1 and zebra-consensus version 5.0.2.","datePublished":"Apr 21, 2026, 7:18:22 PM","dateUpdated":"Apr 21, 2026, 7:52:58 PM","baseScore":7.2,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H","references":"https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-xvj8-ph7x-65gf\n","aliases":"CVE-2026-40880\nGHSA-xvj8-ph7x-65gf\n","assigner":"GitHub_M","epss":0.26,"enisaIdProduct":[{"id":"63f9388f-339c-3be1-9335-87a9733c29ce","product":{"name":"zebrad","vendor":{"name":"ZcashFoundation"}},"product_version":"\u003c 4.3.1"},{"id":"a82de597-3c91-36ee-901d-d7ca053cee71","product":{"name":"zebra-consensus","vendor":{"name":"ZcashFoundation"}},"product_version":"\u003c 5.0.2"}],"enisaIdVendor":[{"id":"873730be-4add-3caa-b481-1493a8dfea4b","vendor":{"name":"ZcashFoundation"}}],"enisaIdVulnerability":[{"id":"080c166e-5d40-3429-9b51-38c538354ef6","vulnerability":{"id":"GHSA-xvj8-ph7x-65gf","description":"Zebra: Cached Mempool Verification Bypasses Consensus Rules for Ahead-of-Tip Blocks","datePublished":"Apr 18, 2026, 12:41:54 AM","dateUpdated":"Apr 27, 2026, 4:17:07 PM","baseScore":0.0,"references":"https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-xvj8-ph7x-65gf\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-40880\nhttps://github.com/ZcashFoundation/zebra\n","enisa_id":"EUVD-2026-24266\n","aliases":"GHSA-xvj8-ph7x-65gf\nCVE-2026-40880\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 1:55:10 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"f3746adc-37ac-3e6f-a9df-1d66153f713e","vulnerability":{"id":"CVE-2026-40880","description":"ZEBRA is a Zcash node written entirely in Rust. Prior to zebrad version 4.3.1 and zebra-consensus version 5.0.2, a logic error in Zebra\u0027s transaction verification cache could allow a malicious miner to induce a consensus split. By carefully submitting a transaction that is valid for height H+1 but invalid for H+2 and then mining that transaction in a block at height H+2, a miner could cause vulnerable Zebra nodes to accept an invalid block, leading to a consensus split from the rest of the Zcash network. This vulnerability is fixed in zebrad version 4.3.1 and zebra-consensus version 5.0.2.","datePublished":"Apr 21, 2026, 7:18:22 PM","dateUpdated":"Apr 21, 2026, 7:52:58 PM","status":"PUBLISHED","baseScore":7.2,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H","references":"https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-xvj8-ph7x-65gf\n","enisa_id":"EUVD-2026-24266\n","assigner":"GitHub_M","epss":0.26,"dataProcessed":"Oct 27, 2026, 7:16:48 AM","vulnerabilityProduct":[{"id":"5b5ed808-676c-3cc8-8a12-531dfd0efdb5","product":{"name":"zebrad","vendor":{"name":"ZcashFoundation"}},"product_version":"\u003c 4.3.1"},{"id":"f44f9a46-ac46-3b4a-8683-faba542edd29","product":{"name":"zebra-consensus","vendor":{"name":"ZcashFoundation"}},"product_version":"\u003c 5.0.2"}],"vulnerabilityVendor":[{"id":"67c83de3-5b80-31c9-91c5-be0e01c1378c","vendor":{"name":"ZcashFoundation"}}]}}],"enisaIdAdvisory":[]}