ZcashFoundation Zebra up to 4.4.x Handshake meta_addr.rs MetaAddr::new_connected assertion

Summaryinfo

A vulnerability categorized as problematic has been discovered in ZcashFoundation Zebra up to 4.4.x. This affects the function MetaAddr::new_connected of the file zebra-network/src/meta_addr.rs of the component Handshake. The manipulation results in assertion. This vulnerability was named CVE-2026-52829. The attack may be performed from remote. There is no available exploit.

Detailsinfo

A vulnerability was found in ZcashFoundation Zebra up to 4.4.x. It has been classified as problematic. Affected is the function MetaAddr::new_connected of the file zebra-network/src/meta_addr.rs of the component Handshake. The manipulation with an unknown input leads to a assertion vulnerability. CWE is classifying the issue as CWE-617. The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary. This is going to have an impact on availability. CVE summarizes:

ZEBRA is a Zcash node written entirely in Rust. Prior to 4.5.0, an unauthenticated IPv4 peer can deterministically terminate a synced Zebra node using the default Linux dual-stack listener configuration. The handshake path canonicalized an IPv4-mapped IPv6 PeerSocketAddr such as ::ffff:127.0.0.1 to plain IPv4 before storing it through MetaAddr::new_connected, but the mempool misbehavior path forwarded the raw transient address to MetaAddrChange::UpdateMisbehavior. In zebra-network/src/meta_addr.rs, apply_to_meta_addr then compared the canonical address-book entry with the raw update address and reached its unexpected address mismatch assertion. After the misbehavior batch flush, panic equals abort terminated zebrad; the peer only needed to complete a P2P handshake and advertise an invalid mempool transaction. This issue is fixed in version 4.5.0.

The advisory is available at github.com. This vulnerability is traded as CVE-2026-52829 since 06/08/2026. The exploitability is told to be easy. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. Technical details are known, but there is no available exploit.

Upgrading to version 4.5.0 eliminates this vulnerability.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Vendor

• ZcashFoundation

Name

• Zebra

Version

• 4.0
• 4.1
• 4.2
• 4.3
• 4.4

Website

• Product: https://github.com/ZcashFoundation/zebra/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion