Zfnd vulnerabilities
We track 4 vulnerabilities in Zfnd products across 3 products. 4 are rated high or critical, and none are known to be exploited. The most recent was published on May 8, 2026.
Latest Zfnd vulnerabilities
- 7.5 High severity
zebra: Incorrect Calculation
ZEBRA is a Zcash node written entirely in Rust. Prior to version 4.4.0, Zebra's block validator undercounts transparent signature operations against the 20000-sigop block limit (MAX_BLOCK_SIGOPS), allowing it to accept blocks that zcashd rejects with bad-blk-s
- 9.1 Critical severity
zebra: Improper Verification of Cryptographic Signature
ZEBRA is a Zcash node written entirely in Rust. Prior to zebrad version 4.4.0 and prior to zebra-script version 6.0.0, the fix for CVE-2026-41583 introduced a separate issue due to insufficient error handling of the case where the sighash type is invalid, duri
- 7.5 High severity
zebra: Reachable Assertion
ZEBRA is a Zcash node written entirely in Rust. Prior to zebrad version 4.3.1 and prior to zebra-chain version 6.0.2, Orchard transactions contain a rk field which is a randomized validating key and also an elliptic curve point. The Zcash specification allows
- 9.1 Critical severity
zebra: Improper Following of Specification by Caller
ZEBRA is a Zcash node written entirely in Rust. Prior to zebrad version 4.3.1 and prior to zebra-script version 5.0.2, after a refactoring, Zebra failed to validate a consensus rule that restricted the possible values of sighash hash types for V5 transactions