CVE-2026-44500

ZEBRA is a Zcash node written entirely in Rust. Prior to zebrad version 4.4.0, prior to zebra-chain version 7.0.0, and prior to zebra-network version 6.0.0, several inbound deserialization paths in Zebra allocated buffers sized against generic transport or block-size ceilings before the tighter protocol or consensus limits were enforced. An unauthenticated or post-handshake peer could therefore force the node to preallocate and parse for orders of magnitude more data than the protocol intended, across headers messages, equihash solutions in block headers, Sapling spend vectors in V5/V4 transactions, and coinbase script bytes in blocks. This issue has been patched in zebrad version 4.4.0, zebra-chain version 7.0.0, and zebra-network version 6.0.0.

• CWE-770

• https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-438q-jx8f-cccvExploit, Vendor Advisory

Published

May 8, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-44495Axios is a promise based HTTP client for the browser and Nod…7
• CVE-2026-44496Axios is a promise based HTTP client for the browser and Nod…7.5
• CVE-2026-44497ZEBRA is a Zcash node written entirely in Rust. Prior to zeb…9.1
• CVE-2026-44498ZEBRA is a Zcash node written entirely in Rust. Prior to ver…7.5
• CVE-2026-44499ZEBRA is a Zcash node written entirely in Rust. Prior to ver…8.7
• CVE-2026-4450Out of bounds write in V8 in Google Chrome prior to 146.0.76…8.8
• CVE-2026-44501DataHub is an open-source metadata platform. Prior to 1.5.0.…7.1
• CVE-2026-44502Bugsink is a self-hosted error tracking tool. Prior to 2.1.3…4.3
• CVE-2026-44503The RedirectHandler middleware in microsoft/kiota-java (com.…7
• CVE-2026-44504Aegra is a drop-in replacement for LangSmith Deployments. Pr…8.6
• CVE-2026-44505Nimiq is a Rust implementation of the Nimiq Proof-of-Stake p…5.3
• CVE-2026-44507Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMB…