Loading story…
Several high-severity flaws were disclosed in Zebra, the Rust-based Zcash node implementation, including bugs that can split consensus and remotely crash nodes. CVE-2026-34377 describes a transaction verification cache logic error that could let a malicious miner reuse a valid transaction ID with invalid authorization data, causing vulnerable Zebra nodes to accept an invalid block and diverge from the main Zcash chain. A related advisory said improper sighash hash-type handling could leave isolated Zebra nodes tracking a fraudulent ledger state, creating downstream risk for exchanges, merchants, infrastructure providers, and block explorers that rely on those nodes.
Additional Zebra issues can terminate nodes through denial-of-service conditions. CVE-2026-34202 allows a remote unauthenticated attacker to send a crafted V5 transaction that passes deserialization but panics during transaction ID calculation, while another flaw in Orchard signature verification can trigger a fatal panic when an identity point is used as a randomized validating key. A separate zebra-rpc bug can also crash the daemon through interrupted JSON-RPC requests, though exploitation is more limited because authentication is required and the interface binds to localhost by default. The affected issues were patched in zebrad 4.3.0, with related fixes in zebra-consensus 5.0.1 and zebra-chain 6.0.1.
Track how attackers are adapting to this technology.
6 events from the most recent confirmed update back to the earliest known activity.
A report disclosed a denial-of-service flaw in Orchard signature verification used by Zebra, where an identity point on the Pallas curve can cause an unwrap on None and crash the node. In Zebra, the panic occurs on critical validation threads and leads to immediate node termination.
A report disclosed a denial-of-service vulnerability in zebra-rpc where interrupted JSON-RPC requests can trigger a Rust panic and abort the daemon. The issue requires authentication and is less likely to be exploited broadly because the RPC interface binds to localhost by default.
A later report described the Zebra consensus bug as potentially causing permanent divergence from the main Zcash chain and exposing exchanges, merchants, block explorers, and infrastructure providers to fraudulent ledger views. It also noted the practical severity was reduced because most Zcash mining power runs zcashd, so a Zebra-only fork would likely stall.
A new CVE, CVE-2026-34377, was published for a critical logic error in Zebra's transaction verification cache that could let a malicious miner trigger a consensus split. Affected Zebra nodes could accept an invalid block and diverge from invulnerable Zebra and Zcashd nodes.
Zebra patched the consensus failure issue in zebrad 4.3.0 and zebra-consensus 5.0.1, and patched the V5 transaction hash panic in zebrad 4.3.0 and zebra-chain 6.0.1. The references describe these fixes as addressing consensus-split and denial-of-service risks in affected versions.
The vulnerability later tracked as CVE-2026-34202 was received by security-advisories@github.com on March 31, 2026. The flaw could let a remote unauthenticated attacker crash a Zebra node via a specially crafted V5 transaction.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
5 references tracked. Mallory keeps watching after this page renders.
cvereports.com
Open sourcecvereports.com
Open sourcecvereports.com
Open sourcecvefeed.io
Open sourcecvefeed.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A high-severity denial-of-service flaw tracked as **`CVE-2026-60109`** affects **Zeek** versions earlier than **`8.0.9`**, allowing an unauthenticated remote attacker to crash a sensor by sending a crafted **Kerberos `KRB_ERROR`** message to **port `88`** over UDP or TCP. The bug is a null pointer dereference in Zeek’s Kerberos protocol analyzer caused by a parser and analyzer state mismatch in `proc_padata()`, where an uninitialized `pa_data_element` can be dereferenced after the wrong parsing arm is selected. Advisories say exploitation can be triggered with a single packet, including `KRB_ERROR` messages using error code **`25`** (`KDC_ERR_PREAUTH_REQUIRED`) and PA-DATA types **`2`**, **`3`**, **`11`**, or **`19`**. Zeek has released a fix in commit **`c82e3c734893d932e94310aec0dbeb1ffcea169d`**, which changes error handling to detect `KRB_ERROR` packets directly and avoid parsing error PA-DATA, while adding a regression test and PCAP reproducing the crash with embedded **`PA-ENC-TIMESTAMP`** data. Organizations running Zeek are advised to upgrade to **`8.0.9`** or later and apply vendor patches.
Jul 10, 2026
A public disclosure detailed eight **OpenZFS on Linux** vulnerabilities, tracked as `OZ-1` through `OZ-8`, that weaken authorization checks and expose multiple import-time parser bugs. The report says pool-control ioctls improperly trust namespace-local `CAP_SYS_ADMIN` from unprivileged user namespaces and containers when `/dev/zfs` is accessible, allowing host pool operations from confined environments. Reported parser flaws include out-of-bounds reads and writes, a controlled heap overflow, a stack overflow, unbounded traversal, and a cache-destroy hang; `OZ-4` was demonstrated as both a container-to-host-root exploit in a research VM and a reliable host-kernel denial-of-service path via malicious OCI images on **TrueNAS SCALE** and **IncusOS**. Testing cited in the disclosure covered **IncusOS, TrueNAS SCALE, Proxmox VE, and Unraid**, while noting that a tested **RHEL 10.2** configuration with **OpenZFS 2.2.10** plus **SELinux/STIG/FIPS** blocked `OZ-1` and `OZ-2`. The report said all OZ findings remained unfixed in upstream master as of `2026-07-24`, except for `OZ-7`, which had an open contested pull request. Separately, Linux kernel documentation notes that kernel CVE assignment is conservative, generally tied to fixes already merged into supported stable trees, and excludes unsupported versions and distribution-specific issues, leaving downstream vendors and users to determine applicability and prioritize full released updates over cherry-picking individual fixes.
Aug 17, 2026
Two high-severity vulnerabilities were disclosed in Nimiq's Rust implementation affecting blockchain validation and consensus logic. `CVE-2026-40093` impacts `nimiq-blockchain` version `1.3.0` and earlier because block timestamp validation checks only consistency with the parent block and does not enforce an upper bound against wall-clock time. A malicious block-producing validator can submit blocks dated far into the future, which alters reward calculations in `Policy::supply_at()` and `batch_delay()` and can inflate monetary supply beyond the intended emission schedule. The issue was mapped to `CWE-1284` and published alongside GitHub advisory `GHSA-49xc-52mp-cc9j`. A second flaw, `CVE-2026-33471`, affects `nimiq-block` versions prior to `1.3.0` in `SkipBlockProof::verify`, where quorum validation can be bypassed through out-of-range `BitSet` indices and `u16` truncation. By spacing forged signer indices by `65536`, a malicious validator can make multiple entries collide into the same valid slot and effectively reuse a single BLS signature to satisfy skip block proof checks without the required `2f+1` real signer slots. The vulnerability carries no known workaround, and the fix was released in version `1.3.0`, highlighting risks to both consensus integrity and chain availability if unpatched nodes remain in use.
Jun 29, 2026