CVE-2026-104428: Reachable Assertion in ZcashFoundation zebra
The getblock RPC method in zebra-rpc before 11.0.0, used by the Zcash Foundation's Zebra node, panics on verbosity 2 for a side-chain block because the block's -1 confirmations sentinel is converted to u32 with .expect(), aborting the process. Remote unauthenticated attackers, directly or through lightwalletd, can repeat this call to keep the node in a crash loop.
AI Analysis
Technical Summary
The vulnerability exists in the getblock RPC method of zebra-rpc prior to version 11.0.0. When the method is invoked with verbosity 2 on a side-chain block, the block's -1 confirmations sentinel value is converted to a u32 type using .expect(), which causes a panic and aborts the process. Remote unauthenticated attackers can exploit this by repeatedly invoking the RPC call directly or via lightwalletd, causing the node to enter a crash loop.
Potential Impact
Remote unauthenticated attackers can cause a denial of service by crashing the Zebra node repeatedly, potentially disrupting node availability and blockchain operations relying on this node.
Mitigation Recommendations
A fix is available in Zebra version 11.0.0 and later. Users should upgrade to version 11.0.0 or newer to remediate this vulnerability. No other mitigation guidance is provided.
CVE-2026-104428: Reachable Assertion in ZcashFoundation zebra
Description
The getblock RPC method in zebra-rpc before 11.0.0, used by the Zcash Foundation's Zebra node, panics on verbosity 2 for a side-chain block because the block's -1 confirmations sentinel is converted to u32 with .expect(), aborting the process. Remote unauthenticated attackers, directly or through lightwalletd, can repeat this call to keep the node in a crash loop.
CVSS v4.0
Score 6.9medium
Affected software
ZcashFoundation
zebra
pkg:github/zcashfoundation/zebraRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability exists in the getblock RPC method of zebra-rpc prior to version 11.0.0. When the method is invoked with verbosity 2 on a side-chain block, the block's -1 confirmations sentinel value is converted to a u32 type using .expect(), which causes a panic and aborts the process. Remote unauthenticated attackers can exploit this by repeatedly invoking the RPC call directly or via lightwalletd, causing the node to enter a crash loop.
Potential Impact
Remote unauthenticated attackers can cause a denial of service by crashing the Zebra node repeatedly, potentially disrupting node availability and blockchain operations relying on this node.
Mitigation Recommendations
A fix is available in Zebra version 11.0.0 and later. Users should upgrade to version 11.0.0 or newer to remediate this vulnerability. No other mitigation guidance is provided.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-10-02T00:46:23.831Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6abf99b0a43b0b3b89b26942
Added to database: 10/02/2026, 11:46:56 UTC
Last enriched: 10/02/2026, 12:02:27 UTC
Last updated: 10/03/2026, 03:10:06 UTC
Views: 13
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.