Advisory Database
  • Advisories
  • Dependency Scanning
  1. cargo
  2. ›
  3. zebrad
  4. ›
  5. GHSA-452v-w3gx-72wg

GHSA-452v-w3gx-72wg: Zebra has rk Identity Point Panic in Transaction Verification

April 18, 2026

Orchard transactions contain a rk field which is a randomized validating key and also an elliptic curve point. The Zcash specification allows the field to be the identity (a “zero” value), however, the orchard crate which is used to verify Orchard proofs would panic when fed a rk with the identity value. Thus an attacker could send a crafted transaction that would make a Zebra node crash.

References

  • github.com/ZcashFoundation/zebra
  • github.com/ZcashFoundation/zebra/security/advisories/GHSA-452v-w3gx-72wg
  • github.com/advisories/GHSA-452v-w3gx-72wg

Code Behaviors & Features

Detect and mitigate GHSA-452v-w3gx-72wg with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →

Affected versions

All versions before 4.3.1

Fixed versions

  • 4.3.1

Solution

Upgrade to version 4.3.1 or above.

Impact 8.6 HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

Learn more about CVSS

Weakness

  • CWE-617: Reachable Assertion

Source file

cargo/zebrad/GHSA-452v-w3gx-72wg.yml

Spotted a mistake? Edit the file on GitLab.

  • Site Repo
  • About GitLab
  • Terms
  • Privacy Statement
  • Contact

Page generated Sat, 09 May 2026 12:18:31 +0000.