CVE-2026-44499

ZEBRA is a Zcash node written entirely in Rust. Prior to version 4.4.0, a composite denial-of-service vulnerability in Zebra's block discovery pipeline allows an unauthenticated remote attacker to permanently halt all new block discovery on a targeted node. The attack exploits three independent weaknesses in the gossip, syncer, and download subsystems — all exercisable from a single TCP connection — to create a monotonically growing block deficit that never self-heals. This issue has been patched in version 4.4.0.

• CWE-770

• https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-h9hm-m2xj-4rq9

Published

May 8, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-44492Axios is a promise based HTTP client for the browser and Nod…8.6
• CVE-2026-44494Axios is a promise based HTTP client for the browser and Nod…8.7
• CVE-2026-44495Axios is a promise based HTTP client for the browser and Nod…7.7
• CVE-2026-44496Axios is a promise based HTTP client for the browser and Nod…7.5
• CVE-2026-44497ZEBRA is a Zcash node written entirely in Rust. Prior to zeb…9.1
• CVE-2026-44498ZEBRA is a Zcash node written entirely in Rust. Prior to ver…7.5
• CVE-2026-4450Out of bounds write in V8 in Google Chrome prior to 146.0.76…8.8
• CVE-2026-44500ZEBRA is a Zcash node written entirely in Rust. Prior to zeb…5.3
• CVE-2026-44501DataHub is an open-source metadata platform. Prior to 1.5.0.…7.1
• CVE-2026-44502Bugsink is a self-hosted error tracking tool. Prior to 2.1.3…4.3
• CVE-2026-44503The RedirectHandler middleware in microsoft/kiota-java (com.…7
• CVE-2026-44504Aegra is a drop-in replacement for LangSmith Deployments. Pr…8.6