CVE-2026-104428: Zebra before 11.0.0 Denial of Service via getblock Verbosity 2
The getblock RPC method in zebra-rpc before 11.0.0, used by the Zcash Foundation's Zebra node, panics on verbosity 2 for a side-chain block because the block's -1 confirmations sentinel is converted to u32 with .expect(), aborting the process. Remote unauthenticated attackers, directly or through lightwalletd, can repeat this call to keep the node in a crash loop.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this denial of service?
Zcash Foundation Zebra nodes running zebra-rpc before 11.0.0 are affected. The issue can be reached either by direct RPC access or indirectly through lightwalletd.
What does an attacker need to trigger the crash?
An unauthenticated remote attacker needs to invoke getblock with verbosity 2 for a side-chain block. The call causes the process to abort, and repeated requests can maintain a crash loop.
Is data confidentiality or integrity affected?
The provided severity vector indicates no confidentiality or integrity impact. The impact is limited to availability through process termination.