{"id":"EUVD-2026-28801","enisaUuid":"feaf1acb-1b4d-3b81-a492-16574b3a8dd0","description":"ZEBRA is a Zcash node written entirely in Rust. Prior to version 4.4.0, a composite denial-of-service vulnerability in Zebra\u0027s block discovery pipeline allows an unauthenticated remote attacker to permanently halt all new block discovery on a targeted node. The attack exploits three independent weaknesses in the gossip, syncer, and download subsystems — all exercisable from a single TCP connection — to create a monotonically growing block deficit that never self-heals. This issue has been patched in version 4.4.0.","datePublished":"May 8, 2026, 3:11:24 PM","dateUpdated":"May 8, 2026, 5:23:27 PM","baseScore":8.7,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","references":"https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-h9hm-m2xj-4rq9\n","aliases":"CVE-2026-44499\n","assigner":"GitHub_M","epss":0.35,"enisaIdProduct":[{"id":"0be4509e-ffaf-320e-b790-66b871369b5c","product":{"name":"zebra","vendor":{"name":"ZcashFoundation"}},"product_version":"\u003c 4.4.0"}],"enisaIdVendor":[{"id":"a2674cb8-26b7-3a5e-9e80-c297e7228aa5","vendor":{"name":"ZcashFoundation"}}],"enisaIdVulnerability":[{"id":"5269dee0-9d71-3963-ac5c-77bd15761802","vulnerability":{"id":"CVE-2026-44499","description":"ZEBRA is a Zcash node written entirely in Rust. Prior to version 4.4.0, a composite denial-of-service vulnerability in Zebra\u0027s block discovery pipeline allows an unauthenticated remote attacker to permanently halt all new block discovery on a targeted node. The attack exploits three independent weaknesses in the gossip, syncer, and download subsystems — all exercisable from a single TCP connection — to create a monotonically growing block deficit that never self-heals. This issue has been patched in version 4.4.0.","datePublished":"May 8, 2026, 3:11:24 PM","dateUpdated":"May 8, 2026, 5:23:27 PM","status":"PUBLISHED","baseScore":8.7,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","references":"https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-h9hm-m2xj-4rq9\n","enisa_id":"EUVD-2026-28801\n","assigner":"GitHub_M","epss":0.35,"dataProcessed":"Oct 30, 2026, 7:17:58 AM","vulnerabilityProduct":[{"id":"4493fe7f-7fdb-31d0-bdeb-b93098ce76b6","product":{"name":"zebra","vendor":{"name":"ZcashFoundation"}},"product_version":"\u003c 4.4.0"}],"vulnerabilityVendor":[{"id":"4d9dc28e-eb28-3594-b961-d657e57bcb9e","vendor":{"name":"ZcashFoundation"}}]}},{"id":"b076da6c-44f2-363a-b2d0-448f13c15ad3","vulnerability":{"id":"GHSA-h9hm-m2xj-4rq9","description":"Zebra has Permanent Block Discovery Halt via Gossip Queue Saturation and Syncer Poisoning","datePublished":"May 8, 2026, 7:12:35 PM","dateUpdated":"May 8, 2026, 7:12:35 PM","baseScore":0.0,"references":"https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-h9hm-m2xj-4rq9\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-44499\nhttps://github.com/ZcashFoundation/zebra\n","enisa_id":"EUVD-2026-28801\n","aliases":"GHSA-h9hm-m2xj-4rq9\nCVE-2026-44499\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 1:55:50 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}