Zebra network: Zebra Address Book Aborted by IPv4-Mapped Mempool Misbehavior Update (CVE-2026-52829)
ZEBRA is a Zcash node written entirely in Rust. Prior to 4.5.0, an unauthenticated IPv4 peer can deterministically terminate a synced Zebra node using the default Linux dual-stack listener configuration. The handshake path canonicalized an IPv4-mapped IPv6 PeerSocketAddr such as ::ffff:127.0.0.1 to plain IPv4 before storing it through MetaAddr::new_connected, but the mempool misbehavior path forwarded the raw transient address to MetaAddrChange::UpdateMisbehavior. In zebra-network/src/meta_addr.rs, apply_to_meta_addr then compared the canonical address-book entry with the raw update address and reached its unexpected address mismatch assertion. After the misbehavior batch flush, panic equals abort terminated zebrad; the peer only needed to complete a P2P handshake and advertise an invalid mempool transaction. This issue is fixed in version 4.5.0.
AI Analysis
Technical Summary
CVE-2026-52829 affects Zebra network nodes running zebrad up to and including v4.4.1 on Linux hosts with default dual-stack IPv6/IPv4 socket configuration (net.ipv6.bindv6only=0). The vulnerability is due to an address normalization mismatch: the handshake path canonicalizes IPv4-mapped IPv6 addresses to plain IPv4 before storing peers in the address book, while the mempool misbehavior path forwards the raw IPv4-mapped IPv6 address without canonicalization. This mismatch triggers an assertion failure in the address book when updating misbehavior penalties, causing the process to abort. An attacker can exploit this by completing a P2P handshake over IPv4 and advertising an invalid mempool transaction, leading to a crash after a 30-second misbehavior batch flush. The issue is fixed in Zebra 4.5.0 by canonicalizing addresses in the misbehavior update path. Workarounds include binding to an IPv4-only address or setting net.ipv6.bindv6only=1 on Linux to prevent dual-stack acceptance.
Potential Impact
A remote unauthenticated attacker can cause a deterministic crash of any synced Zebra node running the default Linux dual-stack configuration by sending a single invalid mempool transaction advertisement over IPv4. This results in a process abort due to an assertion failure, causing persistent downtime as the crash can be repeated after each restart. The attack requires no special privileges, mining capability, RPC access, or funds. The default production configuration on Linux is vulnerable, making this a high-impact denial-of-service vulnerability.
Mitigation Recommendations
A patch is available in Zebra version 4.5.0 that fixes the address normalization mismatch by canonicalizing addresses in the mempool misbehavior update path. Users should upgrade to Zebra 4.5.0 or later to remediate this issue. As a workaround, configuring the node to listen on an IPv4-only address (e.g., 0.0.0.0:8233) or setting the Linux kernel parameter net.ipv6.bindv6only=1 will prevent the vulnerability by avoiding IPv4-mapped IPv6 socket addresses. These workarounds mitigate the issue until the official patch can be applied.
Zebra network: Zebra Address Book Aborted by IPv4-Mapped Mempool Misbehavior Update (CVE-2026-52829)
Description
ZEBRA is a Zcash node written entirely in Rust. Prior to 4.5.0, an unauthenticated IPv4 peer can deterministically terminate a synced Zebra node using the default Linux dual-stack listener configuration. The handshake path canonicalized an IPv4-mapped IPv6 PeerSocketAddr such as ::ffff:127.0.0.1 to plain IPv4 before storing it through MetaAddr::new_connected, but the mempool misbehavior path forwarded the raw transient address to MetaAddrChange::UpdateMisbehavior. In zebra-network/src/meta_addr.rs, apply_to_meta_addr then compared the canonical address-book entry with the raw update address and reached its unexpected address mismatch assertion. After the misbehavior batch flush, panic equals abort terminated zebrad; the peer only needed to complete a P2P handshake and advertise an invalid mempool transaction. This issue is fixed in version 4.5.0.
CVSS v3.1
Score 7.5high
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-52829 affects Zebra network nodes running zebrad up to and including v4.4.1 on Linux hosts with default dual-stack IPv6/IPv4 socket configuration (net.ipv6.bindv6only=0). The vulnerability is due to an address normalization mismatch: the handshake path canonicalizes IPv4-mapped IPv6 addresses to plain IPv4 before storing peers in the address book, while the mempool misbehavior path forwards the raw IPv4-mapped IPv6 address without canonicalization. This mismatch triggers an assertion failure in the address book when updating misbehavior penalties, causing the process to abort. An attacker can exploit this by completing a P2P handshake over IPv4 and advertising an invalid mempool transaction, leading to a crash after a 30-second misbehavior batch flush. The issue is fixed in Zebra 4.5.0 by canonicalizing addresses in the misbehavior update path. Workarounds include binding to an IPv4-only address or setting net.ipv6.bindv6only=1 on Linux to prevent dual-stack acceptance.
Potential Impact
A remote unauthenticated attacker can cause a deterministic crash of any synced Zebra node running the default Linux dual-stack configuration by sending a single invalid mempool transaction advertisement over IPv4. This results in a process abort due to an assertion failure, causing persistent downtime as the crash can be repeated after each restart. The attack requires no special privileges, mining capability, RPC access, or funds. The default production configuration on Linux is vulnerable, making this a high-impact denial-of-service vulnerability.
Mitigation Recommendations
A patch is available in Zebra version 4.5.0 that fixes the address normalization mismatch by canonicalizing addresses in the mempool misbehavior update path. Users should upgrade to Zebra 4.5.0 or later to remediate this issue. As a workaround, configuring the node to listen on an IPv4-only address (e.g., 0.0.0.0:8233) or setting the Linux kernel parameter net.ipv6.bindv6only=1 will prevent the vulnerability by avoiding IPv4-mapped IPv6 socket addresses. These workarounds mitigate the issue until the official patch can be applied.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-63wg-wjjj-7cp8
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-52829"]
- Ecosystems
- ["crates.io"]
- Database Specific Severity
- HIGH
- Cvss Version
- 3.1
Threat ID: 6a46ecb227e9c7971943c58b
Added to database: 07/02/2026, 22:56:50 UTC
Last enriched: 08/19/2026, 11:13:15 UTC
Last updated: 09/14/2026, 23:51:33 UTC
Views: 94
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.