CVE-2026-52829: 
Rust vulnerability analysis and mitigation

CVE-2026-52829 is a reachable assertion vulnerability in the Zebra Zcash node implementation (zebrad) that allows a remote unauthenticated attacker to deterministically crash the node process. The vulnerability stems from an address normalization mismatch between the P2P handshake path and the mempool misbehavior path, triggering a fatal assertion panic. It affects zebrad up to and including v4.4.1 and zebra-network up to and including v6.0.0, specifically on Linux hosts using the default dual-stack IPv6 listener configuration. The vulnerability was first published on May 29, 2026, and added to the GitHub Advisory Database on July 2, 2026. It carries a CVSS v3.1 base score of 7.5 (High) (GitHub Advisory, Zebra Advisory).

The root cause is classified as CWE-617 (Reachable Assertion) and CWE-843 (Type Confusion). On Linux with net.ipv6.bindv6only=0 (the default), IPv4 connections accepted by a [::] dual-stack listener are represented internally as IPv4-mapped IPv6 addresses (e.g., ::ffff:127.0.0.1:8233). The handshake path canonicalizes these to plain IPv4 via MetaAddr::new_connected before storing in the address book, but the inbound inventory registration path preserves the raw IPv4-mapped form via connected_addr.get_transient_addr(). When the mempool generates a misbehavior penalty for this peer (e.g., due to an invalid transaction), the raw IPv4-mapped address is forwarded through MetaAddrChange::UpdateMisbehavior without canonicalization. After the 30-second misbehavior batch flush, AddressBook::update retrieves the canonical IPv4 entry but MetaAddrChange::apply_to_meta_addr asserts previous.addr == self.addr(), which fails due to the IPv4 vs. IPv4-mapped IPv6 mismatch — and since panic = "abort" is set, the process terminates immediately (GitHub Advisory, Zebra Advisory).

A remote unauthenticated attacker can deterministically crash any synced zebrad node running the default Linux dual-stack configuration, causing complete loss of availability. The attack requires no mining capability, no RPC access, no funds, and no special privileges — only the ability to complete a P2P handshake and advertise a single invalid mempool transaction. Because the crash can be repeated after each node restart, the attack enables persistent denial of service, potentially disrupting Zcash network participation, transaction relay, and block validation for affected node operators (GitHub Advisory, Zebra Advisory).

No public exploit code or in-the-wild exploitation has been reported as of the advisory publication date. The vulnerability is highly exploitable in practice: it requires no authentication, no special resources, and targets the default production configuration of zebrad on Linux. The attack is deterministic and repeatable, making it trivially weaponizable by any network peer. No CISA KEV catalog listing or threat actor attribution has been identified. The CVE status is listed as "Reserved" and no EPSS score is currently published (GitHub Advisory).

1. Reconnaissance: Identify publicly reachable zebrad nodes (default port 8233) on Linux hosts, which by default listen on [::] with net.ipv6.bindv6only=0. These represent the standard production deployment.
2. Establish P2P connection via IPv4: Connect to the target node over IPv4 (e.g., 127.0.0.1:8233). The dual-stack listener accepts the connection and internally represents it as an IPv4-mapped IPv6 address (e.g., ::ffff:127.0.0.1:8233).
3. Complete P2P handshake: Perform the standard Zcash P2P handshake so the node registers the peer in its address book using the canonicalized IPv4 address, while the transient inventory registration retains the raw IPv4-mapped form.
4. Advertise an invalid mempool transaction: Send an invalid transaction (e.g., a coinbase transaction) to the target node. The node's mempool will attempt to download and validate it, fail, and generate a misbehavior penalty for the peer using the raw IPv4-mapped address.
5. Wait for the 30-second misbehavior batch flush: After approximately 30 seconds, AddressBook::update processes the MetaAddrChange::UpdateMisbehavior event. The address mismatch between the canonical IPv4 entry and the IPv4-mapped IPv6 change triggers the assertion in apply_to_meta_addr, causing panic = "abort" to terminate the zebrad process.
6. Repeat after restart: Re-connect and repeat the attack after each node restart to maintain persistent denial of service (GitHub Advisory, Zebra Advisory).

• Logs: Sudden zebrad process termination with a Rust panic or abort message referencing apply_to_meta_addr or an address assertion failure in the address book component; repeated node restarts in a short timeframe.
• Network: Inbound IPv4 P2P connections to port 8233 from unfamiliar peers shortly before each crash; peers advertising coinbase or otherwise invalid transactions.
• Process: Unexpected zebrad process exits (exit code indicating abort/signal 6) without prior graceful shutdown; monitoring systems detecting repeated service restarts.
• File System: Core dump files generated by the abort signal if core dumps are enabled on the host, potentially containing stack traces referencing AddressBook::update or MetaAddrChange::apply_to_meta_addr (GitHub Advisory).

The vulnerability is patched in zebrad v4.5.0 and zebra-network v7.0.0, which introduce a new MetaAddr::new_misbehavior constructor that applies canonical_peer_addr before creating the UpdateMisbehavior change, eliminating the address mismatch. Node operators unable to upgrade immediately can apply one of two workarounds: configure listen_addr to an IPv4-only address (e.g., 0.0.0.0:8233) to avoid IPv4-mapped IPv6 representation, or set net.ipv6.bindv6only=1 on Linux to prevent dual-stack acceptance. Upgrading to v4.5.0 is the recommended long-term solution (GitHub Advisory, Zebra Advisory).

The vulnerability was reported by security researcher @Haxatron and coordinated by @mpguerra (coordinator) and @oxarbitrage (remediation developer) at the Zcash Foundation. The advisory was initially published privately on May 29, 2026, and publicly disclosed on July 2, 2026, following the release of the patched version. No significant broader media coverage or notable community commentary beyond the official advisory has been identified (Zebra Advisory).