CVE-2026-41585 json
ZEBRA: Denial of Service via Interrupted JSON-RPC Requests from Authenticated Clients
published 6mo ago modified 4mo ago also GHSA-29x4-r6jv-ff4w , EUVD-2026-28655
- cvss
- 6.5
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.3%
- EPSS 0.3% chance of exploitation in 30 days, percentile 17%
- public exploits
- 0
- none known
Summary
ZEBRA is a Zcash node written entirely in Rust. From zebrad versions 2.2.0 to before 4.3.1 and from zebra-rpc versions 1.0.0-beta.45 to before 6.0.2, a vulnerability in Zebra's JSON-RPC HTTP middleware allows an authenticated RPC client to cause a Zebra node to crash by disconnecting before the request body is fully received. The node treats the failure to read the HTTP request body as an unrecoverable error and aborts the process instead of returning an error response. This issue has been patched in zebrad version 4.3.1 and zebra-rpc version 6.0.2.
Patch / fix
- crates.io zebra-rpc 6.0.2
- crates.io zebrad 4.3.1
- zfnd zebra-rpc 6.0.2
- zfnd zebrad 4.3.1
Is CVE-2026-41585 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 6mo ago
Exploit prediction
0.26% chance of exploitation in the next 30 days, higher than 17% of all scored CVEs (FIRST EPSS, 2026-11-09).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 6.9 | CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H |
| CNA | 4.0 | 6.9 | CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| NVD | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
| GitHub | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| crates.io | zebra-rpc | >=1.0.0-beta.45, <6.0.2 |
6.0.2 |
| crates.io | zebrad | >=2.2.0, <4.3.1 |
4.3.1 |
Affected products
- ZcashFoundation zebra
Classification
References
-
github.com
/ZcashFoundation/zebra/security/advisories/GHSA-29x4-r6jv-ff4w
web, mitigation, vendor-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2026-41585
advisory
-
github.com
/ZcashFoundation/zebra
package
Sources
- CVE List CVE-2026-41585
- GitHub Advisory GHSA-29x4-r6jv-ff4w
- NVD CVE-2026-41585
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.