{"id":"CVE-2026-52829","kind":"vulnerability","aliases":["CVE-2026-52829","GHSA-63wg-wjjj-7cp8"],"related":[],"title":"Zebra Address Book Aborted by IPv4-Mapped Mempool Misbehavior Update","description":"### Am I affected\n\nYou are affected if:\n\n1. You run `zebrad` up to and including `v4.4.1`.\n2. Your node listens on the default `[::]` address on a Linux host (the standard deployment configuration — `net.ipv6.bindv6only=0` is the default on all common Linux distributions).\n3. Your node is synced near the chain tip (the expected production state for any node participating in the network).\n\n### Summary\n\nAn address normalization mismatch between the handshake path and the mempool misbehavior path causes a deterministic assertion panic when a peer connects via IPv4 to a dual-stack IPv6 listener and then triggers a mempool misbehavior penalty.\n\nThe handshake path canonicalizes IPv4-mapped IPv6 addresses to plain IPv4 when storing the peer in the address book via `MetaAddr::new_connected`. The mempool misbehavior path forwards the raw transient socket address (IPv4-mapped IPv6 form) when sending `MetaAddrChange::UpdateMisbehavior` to the address book. The address book looks up the canonical IPv4 entry but then asserts that the previous entry's address matches the change's address. The mismatch between the canonical IPv4 address and the raw IPv4-mapped IPv6 address triggers the assertion, and `panic = \"abort\"` terminates the process.\n\n### Details\n\nOn Linux with `net.ipv6.bindv6only=0`, an IPv4 connection accepted by a `[::]` listener is represented internally as an IPv4-mapped IPv6 socket address (e.g., `::ffff:127.0.0.1:8233`). Zebra's `canonical_peer_addr` helper converts these to plain IPv4 (e.g., `127.0.0.1:8233`).\n\nThe handshake path uses `MetaAddr::new_connected`, which canonicalizes the address before storing in the address book. However, inbound inventory registration uses `connected_addr.get_transient_addr()`, preserving the raw IPv4-mapped form. When the mempool later downloads an invalid transaction from this peer and generates a misbehavior penalty, the raw transient address is forwarded through the misbehavior channel to `MetaAddrChange::UpdateMisbehavior`, which does not canonicalize.\n\nAfter the 30-second misbehavior batch flush, `AddressBook::update` retrieves the canonical IPv4 entry but `MetaAddrChange::apply_to_meta_addr` asserts that `previous.addr == self.addr()`, which fails because one is IPv4 and the other is IPv4-mapped IPv6.\n\nThe attacker needs only to complete a P2P handshake over IPv4 to a dual-stack listener and advertise an invalid mempool transaction (such as a coinbase transaction). The assertion fires after the 30-second misbehavior batch flush.\n\n### Patches\n\nPatched in Zebra 4.5.0. The fix canonicalizes the address in the misbehavior update path via a new `MetaAddr::new_misbehavior` constructor that applies `canonical_peer_addr` before creating the `UpdateMisbehavior` change.\n\n### Workarounds\n\nConfiguring `listen_addr` to an IPv4-only address (e.g., `0.0.0.0:8233`) avoids the IPv4-mapped IPv6 representation and prevents this specific assertion. Alternatively, setting `net.ipv6.bindv6only=1` on Linux prevents dual-stack acceptance.\n\n### Impact\n\nA remote unauthenticated peer can deterministically crash any synced Zebra node running the default Linux dual-stack configuration with a single invalid mempool transaction advertisement, followed by a 30-second wait. The attack requires no mining capability, no RPC access, no funds, and no special privileges. The crash can be repeated after each restart, causing persistent downtime. Linux dual-stack sockets and mempool activation are the default production state, not special preconditions.\n\n### Credit\n\nReported by `@Haxatron`.","summary":"A remote peer that connects to Zebra over IPv4 on a dual-stack listener and sends an invalid mempool transaction triggers an address mismatch assertion. Because Zebra is built with panic set to abort, the whole node process terminates, and the crash repeats after each restart.","severity":"high","cvss":7.5,"epss":0.00609,"exploited":false,"exploited_at":null,"products":[{"name":"zebra-network","fixed":["7.0.0"],"affected":"<= 6.0.0","ecosystem":"cargo"},{"name":"zebrad","fixed":["4.5.0"],"affected":"<= 4.4.1","ecosystem":"cargo"}],"ecosystems":["cargo"],"tags":["cargo","cwe-617","cwe-843","linux","package","self-hosted","zcash","zebrad"],"not_affected_if":["bindv6only-1","ipv4-only-listener","non-linux"],"how_to_check":"- Check the installed version with `zebrad --version`; affected versions are up to and including `4.4.1`.\n- Check `listen_addr` in the zebrad config; a default `[::]` dual-stack listener on Linux is the exposed setup.\n- Check `sysctl net.ipv6.bindv6only`; `0` is the common default and is exposed.","fix":"- `zebrad`: upgrade to `4.5.0`\n- `zebra-network`: upgrade to `7.0.0` (affected up to and including `6.0.0`)","status":"open","published_at":"2026-07-02T20:26:56+00:00","first_seen_at":"2026-11-13T02:43:33+00:00","triaged_at":"2026-11-13T02:45:00+00:00","updated_at":"2026-11-13T02:45:00+00:00","category":"package","confidence":0.85,"triage":{"at":"2026-11-13T02:45:00Z","model":"claude-haiku-5-5","output":{"fix":"- `zebrad`: upgrade to `4.5.0`\n- `zebra-network`: upgrade to `7.0.0` (affected up to and including `6.0.0`)","reach":"internet","title":"Zebra: IPv4 peer's mempool misbehavior crashes node via address assertion","impact":"medium","summary":"A remote peer that connects to Zebra over IPv4 on a dual-stack listener and sends an invalid mempool transaction triggers an address mismatch assertion. Because Zebra is built with panic set to abort, the whole node process terminates, and the crash repeats after each restart.","audience":"businesses","category":"package","nicknames":[],"who_cares":["zebrad","zcash","self-hosted","linux","cargo"],"confidence":0.85,"fix_status":"available","needs_auth":"no","worst_case":"remote peer crashes the node process repeatedly after restarts","analyst_note":"","how_to_check":"- Check the installed version with `zebrad --version`; affected versions are up to and including `4.4.1`.\n- Check `listen_addr` in the zebrad config; a default `[::]` dual-stack listener on Linux is the exposed setup.\n- Check `sysctl net.ipv6.bindv6only`; `0` is the common default and is exposed.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["ipv4-only-listener","bindv6only-1","non-linux"],"who_is_affected":"Operators running zebrad nodes on Linux with the default dual-stack IPv6 listener (`[::]`) and a synced chain are exposed, because IPv4 peers arrive as IPv4-mapped IPv6 addresses. Nodes bound only to an IPv4 address, or with `net.ipv6.bindv6only=1`, are not affected according to the advisory's workarounds.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000932,"input_tokens":5907,"output_tokens":683,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,21A '-52829':14A,22A '-617':29B '-843':31B '0':119C,286C '0.0.0.0':507C '1':93C,524C '127.0.0.1':307C,321C '2':102C '3':128C '30':390C,459C,562C '4.5.0':468C '63wg':17A '7cp8':19A '8233':308C,322C,508C 'abort':4A,73B,277C 'accept':290C,531C 'access':573C 'activ':598C 'addr':313C,347C,407C,490C,499C 'address':2A,62B,109C,150C,195C,205C,220C,232C,235C,251C,256C,263C,271C,304C,333C,338C,374C,473C,505C 'addressbook':395C 'advertis':444C,558C 'affect':88C,91C 'altern':521C 'appli':404C,487C 'assert':64B,165C,245C,274C,408C,455C,520C 'attack':427C,566C 'avoid':509C 'batch':393C,462C 'book':3A,206C,233C,236C,339C 'built':68B 'canon':240C,261C,311C,399C,488C 'canonic':190C,331C,387C,471C 'capabl':570C 'cargo':27B 'caus':162C,588C 'chain':135C 'chang':254C,495C 'channel':380C 'coinbas':452C 'common':125C 'complet':431C 'configur':117C,497C,551C 'connect':43B,170C,210C,289C,329C 'connected_addr.get':345C 'constructor':485C 'convert':315C 'crash':81B,539C,581C 'creat':492C 'credit':607C 'cve':12A,20A 'cwe':28B,30B 'default':108C,122C,546C,601C 'deploy':116C 'detail':281C 'determinist':164C,538C 'distribut':127C 'download':359C 'downtim':590C 'dual':51B,176C,440C,529C,549C,593C 'dual-stack':50B,175C,439C,528C,548C,592C 'e.g':305C,320C,506C 'entri':242C,249C,401C 'expect':138C 'fail':413C 'ffff':306C 'fire':456C 'fix':470C 'flush':394C,463C 'follow':559C 'form':225C,354C 'forward':215C,376C 'fund':575C 'generat':367C 'ghsa':16A 'ghsa-63wg-wjjj-7cp8':15A 'handshak':155C,188C,324C,434C 'haxatron':610C 'helper':314C 'host':36B,113C 'howev':340C 'impact':532C 'inbound':341C 'includ':100C 'intern':296C 'invalid':57B,361C,446C,555C 'inventori':342C 'ipv4':7A,47B,172C,192C,198C,222C,241C,262C,268C,288C,300C,319C,352C,400C,417C,423C,436C,503C,512C 'ipv4-mapped':6A,191C,221C,267C,299C,351C,422C,511C 'ipv4-only':502C 'ipv6':178C,194C,224C,270C,302C,425C,514C 'later':358C 'linux':32B,112C,126C,283C,526C,547C,591C 'listen':53B,105C,179C,293C,442C,498C 'look':237C 'map':8A,193C,223C,269C,301C,353C,424C,513C 'match':252C 'mempool':9A,58B,159C,184C,212C,357C,447C,556C,597C 'meta':406C 'metaaddr':208C,327C,482C 'metaaddrchang':228C,382C,403C 'mine':569C 'misbehavior':10A,160C,185C,213C,369C,379C,392C,461C,476C,484C 'mismatch':63B,152C,258C 'near':133C 'need':428C 'net.ipv6.bindv6only':118C,285C,523C 'network':25A,147C 'new':209C,328C,481C,483C 'node':76B,104C,130C,143C,543C 'normal':151C 'one':415C 'p2p':433C 'packag':33B 'panic':70B,166C,276C 'particip':144C 'patch':464C,465C 'path':156C,161C,189C,214C,325C,478C 'peer':41B,169C,202C,312C,365C,489C,536C 'penalti':186C,370C 'persist':589C 'plain':197C,318C 'precondit':606C 'preserv':348C 'prevent':517C,527C 'previous':248C 'previous.addr':410C 'privileg':579C 'process':77B,280C 'product':139C,602C 'raw':217C,266C,350C,372C 'registr':343C 'remot':40B,534C 'repeat':82B,584C 'report':608C 'repres':295C 'represent':515C 'requir':567C 'restart':85B,587C 'retriev':397C 'rpc':572C 'run':95C,544C 'second':391C,460C,563C 'self':35B 'self-host':34B 'self.addr':411C 'send':55B,227C 'set':71B,522C 'singl':554C 'socket':219C,303C,595C 'special':578C,605C 'specif':519C 'stack':52B,177C,441C,530C,550C,594C 'standard':115C 'state':140C,603C 'store':200C,335C 'summari':148C 'sync':132C,541C 'termin':78B,278C 'tip':136C 'transact':59B,362C,448C,453C,557C 'transient':218C,346C,373C 'trigger':60B,182C,272C 'unauthent':535C 'updat':11A,396C,477C 'updatemisbehavior':229C,383C,494C 'use':326C,344C 'v4.4.1':101C 'via':171C,207C,479C 'wait':564C 'whole':75B 'wjjj':18A 'workaround':496C 'zcash':37B 'zebra':1A,24A,45B,66B,309C,467C,542C 'zebra-network':23A 'zebrad':26A,38B,96C","nicknames":[],"mitigations":[],"who_affected":"Operators running zebrad nodes on Linux with the default dual-stack IPv6 listener (`[::]`) and a synced chain are exposed, because IPv4 peers arrive as IPv4-mapped IPv6 addresses. Nodes bound only to an IPv4 address, or with `net.ipv6.bindv6only=1`, are not affected according to the advisory's workarounds.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["zebrad","zebranetwork"],"ptokens":["network","zebra","zebrad"],"labels":["cargo","cwe617","cwe843","high","linux","package","selfhosted","zcash","zebrad"],"campaign_type":null,"search_a":"'-2026':13A,21A '-52829':14A,22A '63wg':17A '7cp8':19A 'abort':4A 'address':2A 'book':3A 'cve':12A,20A 'ghsa':16A 'ghsa-63wg-wjjj-7cp8':15A 'ipv4':7A 'ipv4-mapped':6A 'map':8A 'mempool':9A 'misbehavior':10A 'network':25A 'updat':11A 'wjjj':18A 'zebra':1A,24A 'zebra-network':23A 'zebrad':26A","search_b":"'-617':29B '-843':31B 'abort':73B 'address':62B 'assert':64B 'built':68B 'cargo':27B 'connect':43B 'crash':81B 'cwe':28B,30B 'dual':51B 'dual-stack':50B 'host':36B 'invalid':57B 'ipv4':47B 'linux':32B 'listen':53B 'mempool':58B 'mismatch':63B 'node':76B 'packag':33B 'panic':70B 'peer':41B 'process':77B 'remot':40B 'repeat':82B 'restart':85B 'self':35B 'self-host':34B 'send':55B 'set':71B 'stack':52B 'termin':78B 'transact':59B 'trigger':60B 'whole':75B 'zcash':37B 'zebra':45B,66B 'zebrad':38B","search_c":"'0':119C,286C '0.0.0.0':507C '1':93C,524C '127.0.0.1':307C,321C '2':102C '3':128C '30':390C,459C,562C '4.5.0':468C '8233':308C,322C,508C 'abort':277C 'accept':290C,531C 'access':573C 'activ':598C 'addr':313C,347C,407C,490C,499C 'address':109C,150C,195C,205C,220C,232C,235C,251C,256C,263C,271C,304C,333C,338C,374C,473C,505C 'addressbook':395C 'advertis':444C,558C 'affect':88C,91C 'altern':521C 'appli':404C,487C 'assert':165C,245C,274C,408C,455C,520C 'attack':427C,566C 'avoid':509C 'batch':393C,462C 'book':206C,233C,236C,339C 'canon':240C,261C,311C,399C,488C 'canonic':190C,331C,387C,471C 'capabl':570C 'caus':162C,588C 'chain':135C 'chang':254C,495C 'channel':380C 'coinbas':452C 'common':125C 'complet':431C 'configur':117C,497C,551C 'connect':170C,210C,289C,329C 'connected_addr.get':345C 'constructor':485C 'convert':315C 'crash':539C,581C 'creat':492C 'credit':607C 'default':108C,122C,546C,601C 'deploy':116C 'detail':281C 'determinist':164C,538C 'distribut':127C 'download':359C 'downtim':590C 'dual':176C,440C,529C,549C,593C 'dual-stack':175C,439C,528C,548C,592C 'e.g':305C,320C,506C 'entri':242C,249C,401C 'expect':138C 'fail':413C 'ffff':306C 'fire':456C 'fix':470C 'flush':394C,463C 'follow':559C 'form':225C,354C 'forward':215C,376C 'fund':575C 'generat':367C 'handshak':155C,188C,324C,434C 'haxatron':610C 'helper':314C 'host':113C 'howev':340C 'impact':532C 'inbound':341C 'includ':100C 'intern':296C 'invalid':361C,446C,555C 'inventori':342C 'ipv4':172C,192C,198C,222C,241C,262C,268C,288C,300C,319C,352C,400C,417C,423C,436C,503C,512C 'ipv4-mapped':191C,221C,267C,299C,351C,422C,511C 'ipv4-only':502C 'ipv6':178C,194C,224C,270C,302C,425C,514C 'later':358C 'linux':112C,126C,283C,526C,547C,591C 'listen':105C,179C,293C,442C,498C 'look':237C 'map':193C,223C,269C,301C,353C,424C,513C 'match':252C 'mempool':159C,184C,212C,357C,447C,556C,597C 'meta':406C 'metaaddr':208C,327C,482C 'metaaddrchang':228C,382C,403C 'mine':569C 'misbehavior':160C,185C,213C,369C,379C,392C,461C,476C,484C 'mismatch':152C,258C 'near':133C 'need':428C 'net.ipv6.bindv6only':118C,285C,523C 'network':147C 'new':209C,328C,481C,483C 'node':104C,130C,143C,543C 'normal':151C 'one':415C 'p2p':433C 'panic':166C,276C 'particip':144C 'patch':464C,465C 'path':156C,161C,189C,214C,325C,478C 'peer':169C,202C,312C,365C,489C,536C 'penalti':186C,370C 'persist':589C 'plain':197C,318C 'precondit':606C 'preserv':348C 'prevent':517C,527C 'previous':248C 'previous.addr':410C 'privileg':579C 'process':280C 'product':139C,602C 'raw':217C,266C,350C,372C 'registr':343C 'remot':534C 'repeat':584C 'report':608C 'repres':295C 'represent':515C 'requir':567C 'restart':587C 'retriev':397C 'rpc':572C 'run':95C,544C 'second':391C,460C,563C 'self.addr':411C 'send':227C 'set':522C 'singl':554C 'socket':219C,303C,595C 'special':578C,605C 'specif':519C 'stack':177C,441C,530C,550C,594C 'standard':115C 'state':140C,603C 'store':200C,335C 'summari':148C 'sync':132C,541C 'termin':278C 'tip':136C 'transact':362C,448C,453C,557C 'transient':218C,346C,373C 'trigger':182C,272C 'unauthent':535C 'updat':396C,477C 'updatemisbehavior':229C,383C,494C 'use':326C,344C 'v4.4.1':101C 'via':171C,207C,479C 'wait':564C 'workaround':496C 'zebra':309C,467C,542C 'zebrad':96C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-05-29T13:56:49+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-63wg-wjjj-7cp8","url":"https://github.com/advisories/GHSA-63wg-wjjj-7cp8","severity":"high","published_at":"2026-07-02T20:26:56+00:00","modified_at":"2026-11-13T02:42:30+00:00","first_seen_at":"2026-11-13T02:43:33+00:00","fetched_at":"2026-11-13T02:52:49+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-52829","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-52829","severity":null,"published_at":"2026-08-18T20:17:18+00:00","modified_at":"2026-10-22T22:10:00+00:00","first_seen_at":"2026-11-13T03:13:22+00:00","fetched_at":"2026-11-13T03:13:22+00:00","note":null}],"documents":[{"id":142044,"url":"https://api.github.com/repos/ZcashFoundation/zebra/security-advisories/GHSA-63wg-wjjj-7cp8","title":"Maintainer's advisory: api.github.com","kind":"vendor","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Maintainer's advisory: api.github.com"},{"id":142045,"url":"https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-63wg-wjjj-7cp8","title":"Maintainer's advisory: github.com","kind":"vendor","source":"ghsa","publisher":"vendor","text":null,"published_at":"2026-05-29T13:56:49+00:00","relation":"advisory","confidence":null,"note":"Maintainer's advisory: github.com"},{"id":142266,"url":"https://github.com/ZcashFoundation/zebra/commit/1440b43ca7df59aca948090d45117557b217a6cd","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":142267,"url":"https://github.com/ZcashFoundation/zebra/releases/tag/v4.5.0","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"}],"disclosures":[],"exploit_sources":[{"type":"epss","score":0.00609,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-52829"}],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}