Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.5
CVE-2026-52829: Zebra Address Book Crashes on IPv4 Connections
CVE-2026-52829 · published 2 months ago
Summary
If you run Zebra on a Linux server with IPv6 enabled and allow IPv4 connections, your address book may crash when a peer connects. This affects Zebra versions up to 4.4.1. To fix, upgrade to a newer version of Zebra.
What to do
- Update conradoplg zebra-network to version 7.0.0.
- Update conradoplg zebrad to version 4.5.0.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| rust | conradoplg | zebra-network |
<= 6.0.0 Fix: upgrade to 7.0.0
|
| – | zcashfoundation | zebra | < 4.5.0 |
| rust | conradoplg | zebrad |
<= 4.4.1 Fix: upgrade to 4.5.0
|
Original advisory text
ZEBRA: IPv4-Mapped Mempool Misbehavior Update Aborts Zebra Address Book
ZEBRA is a Zcash node written entirely in Rust. Prior to 4.5.0, an unauthenticated IPv4 peer can deterministically terminate a synced Zebra node using the default Linux dual-stack listener configuration. The handshake path canonicalized an IPv4-mapped IPv6 PeerSocketAddr such as ::ffff:127.0.0.1 to plain IPv4 before storing it through MetaAddr::new_connected, but the mempool misbehavior path forwarded the raw transient address to MetaAddrChange::UpdateMisbehavior. In zebra-network/src/meta_addr.rs, apply_to_meta_addr then compared the canonical address-book entry with the raw update address and reached its unexpected address mismatch assertion. After the misbehavior batch flush, panic equals abort terminated zebrad; the peer only needed to complete a P2P handshake and advertise an invalid mempool transaction. This issue is fixed in version 4.5.0.
References
- https://github.com/advisories/GHSA-63wg-wjjj-7cp8
- https://github.com/ZcashFoundation/zebra/releases/tag/v4.5.0 URL
- https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-63wg-wjjj-7cp8 Vendor Advisory
- https://github.com/ZcashFoundation/zebra/commit/1440b43ca7df59aca948090d45117557... Patch
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/52xxx/CVE-2026-52829... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-52829 Vendor Advisory
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker partial control
Type
CWE-617Reachable Assertion
CWE-843Type Confusion
Timeline
Published18 Aug 2026
Updated4 Nov 2026
First seen2 Jul 2026
Track software like this
Free during beta