{"id":"EUVD-2026-61172","enisaUuid":"f51463fa-e8af-3569-b6de-7052901e30a5","description":"ZEBRA is a Zcash node written entirely in Rust. Prior to 4.5.0, an unauthenticated IPv4 peer can deterministically terminate a synced Zebra node using the default Linux dual-stack listener configuration. The handshake path canonicalized an IPv4-mapped IPv6 PeerSocketAddr such as ::ffff:127.0.0.1 to plain IPv4 before storing it through MetaAddr::new_connected, but the mempool misbehavior path forwarded the raw transient address to MetaAddrChange::UpdateMisbehavior. In zebra-network/src/meta_addr.rs, apply_to_meta_addr then compared the canonical address-book entry with the raw update address and reached its unexpected address mismatch assertion. After the misbehavior batch flush, panic equals abort terminated zebrad; the peer only needed to complete a P2P handshake and advertise an invalid mempool transaction. This issue is fixed in version 4.5.0.","datePublished":"Aug 18, 2026, 7:27:57 PM","dateUpdated":"Aug 18, 2026, 7:44:56 PM","baseScore":7.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","references":"https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-63wg-wjjj-7cp8\nhttps://github.com/ZcashFoundation/zebra/commit/1440b43ca7df59aca948090d45117557b217a6cd\nhttps://github.com/ZcashFoundation/zebra/releases/tag/v4.5.0\n","aliases":"CVE-2026-52829\nGHSA-63wg-wjjj-7cp8\n","assigner":"GitHub_M","epss":0.61,"enisaIdProduct":[{"id":"8e4cccc5-5eb9-3431-b87c-1cb3124d37a4","product":{"name":"zebra","vendor":{"name":"ZcashFoundation"}},"product_version":"\u003c 4.5.0"}],"enisaIdVendor":[{"id":"1435bd48-1f5c-3ca3-997a-2dd987be8cfd","vendor":{"name":"ZcashFoundation"}}],"enisaIdVulnerability":[{"id":"d105c089-1559-3bbc-b17a-f551998671ac","vulnerability":{"id":"CVE-2026-52829","description":"ZEBRA is a Zcash node written entirely in Rust. Prior to 4.5.0, an unauthenticated IPv4 peer can deterministically terminate a synced Zebra node using the default Linux dual-stack listener configuration. The handshake path canonicalized an IPv4-mapped IPv6 PeerSocketAddr such as ::ffff:127.0.0.1 to plain IPv4 before storing it through MetaAddr::new_connected, but the mempool misbehavior path forwarded the raw transient address to MetaAddrChange::UpdateMisbehavior. In zebra-network/src/meta_addr.rs, apply_to_meta_addr then compared the canonical address-book entry with the raw update address and reached its unexpected address mismatch assertion. After the misbehavior batch flush, panic equals abort terminated zebrad; the peer only needed to complete a P2P handshake and advertise an invalid mempool transaction. This issue is fixed in version 4.5.0.","datePublished":"Aug 18, 2026, 7:27:57 PM","dateUpdated":"Aug 18, 2026, 7:44:56 PM","status":"PUBLISHED","baseScore":7.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","references":"https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-63wg-wjjj-7cp8\nhttps://github.com/ZcashFoundation/zebra/commit/1440b43ca7df59aca948090d45117557b217a6cd\nhttps://github.com/ZcashFoundation/zebra/releases/tag/v4.5.0\n","enisa_id":"EUVD-2026-61172\n","assigner":"GitHub_M","epss":0.61,"dataProcessed":"Oct 28, 2026, 7:15:32 AM","vulnerabilityProduct":[{"id":"bdfee4ae-3817-3a09-a55e-62d9982fe9d4","product":{"name":"zebra","vendor":{"name":"ZcashFoundation"}},"product_version":"\u003c 4.5.0"}],"vulnerabilityVendor":[{"id":"ffd8de3d-4730-3ff5-a7f7-c99fb9e00e80","vendor":{"name":"ZcashFoundation"}}]}},{"id":"dd586440-f939-3452-b62e-b6beae7ccc3f","vulnerability":{"id":"GHSA-63wg-wjjj-7cp8","description":"Zebra Address Book Aborted by IPv4-Mapped Mempool Misbehavior Update","datePublished":"Jul 2, 2026, 8:26:56 PM","dateUpdated":"Jul 2, 2026, 8:26:56 PM","baseScore":0.0,"references":"https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-63wg-wjjj-7cp8\nhttps://github.com/ZcashFoundation/zebra\n","enisa_id":"EUVD-2026-61172\n","aliases":"CVE-2026-52829\nGHSA-63wg-wjjj-7cp8\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 1:57:47 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}