ZEBRA-RPC · GHSA-c8w6-x74f-vmg3 · Package
FIX → 8.0.0 · 4.5.0
A crafted Unified Address passed to the z_listunifiedreceivers RPC call makes the zebrad process panic and exit. A single authenticated request keeps the node down until restarted and the request is filtered.
first public Jul 2, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Only nodes running zebrad with the RPC server enabled are exposed. With the default cookie auth, an attacker needs local read access to the .cookie file; with cookie auth disabled, any network client that can reach the RPC port can trigger the crash. Lightwalletd backends, Zaino indexers and mining pool setups that forward RPC calls to zebrad may be exposed if z_listunifiedreceivers is reachable through them.
Not affected if cookie-auth-default, no-forwarding-of-z_listunifiedreceivers, rpc-disabled
Who cares lightwalletd, mining-pool, zcash, zebra-rpc, zebrad
zebrad --version; affected versions are up to and including 4.4.1.zebrad.toml for rpc.listen_addr; the RPC server is only exposed when it is set.enable_cookie_auth is (the default) or ; with , any network client reaching the RPC port can trigger the crash.You are affected if:
zebrad up to and including v4.4.1.zebrad.toml sets rpc.listen_addr to a TCP address (RPC server is enabled).enable_cookie_auth = true, this requires the attacker to read the .cookie file (typically local access). With enable_cookie_auth = false, any network client reaching the RPC port can trigger it.The z_listunifiedreceivers RPC handler panics when processing a structurally valid Unified Address whose Sapling receiver carries 43 bytes that fail cryptographic validation (sapling_crypto::PaymentAddress::from_bytes returns None for non-subgroup Jubjub points). The handler calls .expect("using data already decoded as valid") on the fallible result. Because Zebra's release profile sets , the panic terminates the entire node process, not just the RPC task.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
truefalsefalseUpgrade to 8.0.0 · 4.5.0
zebrad: upgrade to 4.5.0.zebra-rpc (cargo): upgrade to 8.0.0.panic = "abort"zcash_address::unified::Encoding::decode validates only the structural envelope of a Unified Address (F4Jumble, bech32m, typecode ordering, 43-byte length for Sapling). It does not validate that the embedded pk_d is a valid Jubjub subgroup point or that the diversifier produces a valid g_d preimage.
At zebra-rpc/src/methods.rs:2893, the handler calls Address::try_from_sapling(network, data), which delegates to sapling_crypto::PaymentAddress::from_bytes. When from_bytes returns None (most random 32-byte strings fail the subgroup check), the .expect() fires and the process aborts.
The same crate already handles this correctly in try_from_unified at zebra-chain/src/primitives/address.rs:99-110, which returns Err when from_bytes fails. The vulnerable code path bypasses this validated route.
zebra-rpc 8.0.0 and zebrad 4.5.0.
Replace .expect() with .map_err(|e| ErrorObject::owned(...)) for proper error propagation, or route through the existing try_from_unified path which already handles this case correctly.
rpc.listen_addr from zebrad.toml.enable_cookie_auth = true (the default) and restrict filesystem access to the .cookie file.z_listunifiedreceivers calls with untrusted address parameters.A single authenticated RPC request terminates the zebrad process. The attack is repeatable on restart (the same request triggers the same abort), allowing an attacker to keep the node down indefinitely until the request is filtered upstream. Operators using lightwalletd backends, Zaino indexers, or mining pool infrastructure that forward RPC calls to zebrad may be exposed if the forwarding path passes through z_listunifiedreceivers.
Reported by @robustfengbin via a private GitHub Security Advisory submission.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
GitHub Advisory Database, CC-BY 4.0. Posts quoted belong to their authors.