CVE-2026-40881

{"id": "CVE-2026-40881", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-40881", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-21T19:51:52.666584Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "LOW", "vulnAvailabilityImpact": "LOW", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "ZcashFoundation", "product": "zebrad", "versions": [{"status": "affected", "version": "< 4.3.1"}]}, {"vendor": "ZcashFoundation", "product": "zebra-network", "versions": [{"status": "affected", "version": "< 5.0.1"}]}]}], "published": "2026-04-21T20:17:01.850", "references": [{"url": "https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-xr93-pcq3-pxf8", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-xr93-pcq3-pxf8", "tags": ["Vendor Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-770"}]}], "descriptions": [{"lang": "en", "value": "ZEBRA is a Zcash node written entirely in Rust. Prior to zebrad version 4.3.0 and zebra-network version 5.0.1, when deserializing addr or addrv2 messages, which contain vectors of addresses, Zebra would fully deserialize them up to a maximum length (over 233,000) that was derived from the 2 MiB message size limit. This is much larger than the actual limit of 1,000 messages from the specification. Zebra would eventually check that limit but, at that point, the memory for the larger vector was already allocated. An attacker could cause out-of-memory aborts in Zebra by sending multiple such messages over different connections. This vulnerability is fixed in zebrad version 4.3.0 and zebra-network version 5.0.1."}, {"lang": "es", "value": "ZEBRA es un nodo Zcash escrito completamente en Rust. Antes de la versi\u00f3n 4.3.0 de zebrad y la versi\u00f3n 5.0.1 de zebra-network, al deserializar mensajes addr o addrv2, que contienen vectores de direcciones, Zebra los deserializar\u00eda completamente hasta una longitud m\u00e1xima (m\u00e1s de 233.000) que se derivaba del l\u00edmite de tama\u00f1o de mensaje de 2 MiB. Esto es mucho mayor que el l\u00edmite real de 1.000 mensajes de la especificaci\u00f3n. Zebra eventualmente verificar\u00eda ese l\u00edmite pero, en ese momento, la memoria para el vector m\u00e1s grande ya estaba asignada. Un atacante podr\u00eda causar abortos por falta de memoria en Zebra al enviar m\u00faltiples mensajes de este tipo a trav\u00e9s de diferentes conexiones. Esta vulnerabilidad est\u00e1 corregida en la versi\u00f3n 4.3.0 de zebrad y la versi\u00f3n 5.0.1 de zebra-network."}], "lastModified": "2026-10-26T21:10:00.170", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:zfnd:zebra-network:*:*:*:*:*:rust:*:*", "vulnerable": true, "matchCriteriaId": "1A075964-2131-40A5-AF5E-436DAA8F508C", "versionEndExcluding": "5.0.1"}, {"criteria": "cpe:2.3:a:zfnd:zebrad:*:*:*:*:*:rust:*:*", "vulnerable": true, "matchCriteriaId": "0D5F3C05-ECFC-43B1-9168-8E114125F6B7", "versionEndExcluding": "4.3.1"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}