Zcash Zebra CVE-2026-104428

The Zebra node's getblock JSON-RPC method must be reachable by the attacker - either a directly exposed RPC port or an upstream lightwalletd instance that forwards block queries. The specific trigger is a getblock request with verbosity 2 referencing a side-chain (orphan/non-best-chain) block, whose confirmations value is the -1 sentinel; this is what drives the .expect() panic. No authentication, privileges, or user interaction are required (PR:N/UI:N) and default configurations of affected Zebra versions (<11.0.0) are vulnerable. The primary limiting factor is the need for a side-chain block to exist and be addressable - a routine but not constant condition; impact is confined to availability (node crash/crash loop), with no data exposure or code execution.

This is a remote, unauthenticated denial-of-service in Zebra's getblock RPC (CWE-617, reachable assertion/panic). The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms network reach with low complexity and no privileges or user interaction, and impact is confined to availability (VC:N/VI:N/VA:L, score 6.9) - there is no confidentiality or integrity exposure. The genuine aggravating factor is that the panic aborts the process and the call can be repeated, producing a sustained crash loop rather than a single transient fault, so the real availability impact is arguably higher than the vendor's VA:L (I assess High). Countervailing signals keep this below top priority: no EPSS score was supplied, the CVE is NOT in CISA KEV, and no public exploit code is referenced, so there is no evidence of active or widespread exploitation. Note a conditional prerequisite the raw CVSS obscures - exploitation depends on a side-chain (orphan) block existing and getblock being invoked with verbosity 2 against it; this is a normal occurrence but means it is not a trivially-always-reachable crash. Net: a legitimate patch-worthy availability bug for Zebra operators (especially those exposing RPC or fronting it with lightwalletd), but not a mass-exploitation emergency given the niche footprint and absence of exploitation signals.

A remote unauthenticated attacker with network access to a Zebra node's RPC interface (directly, or indirectly via a lightwalletd service that relays queries) issues a getblock call with verbosity 2 targeting a side-chain block, whose -1 confirmations sentinel is forced into a u32 via .expect() and panics the process. The attacker scripts this call to fire repeatedly, aborting the node each time it restarts and holding it in a crash loop. No public exploit code is identified at time of analysis, but the trigger is a single well-formed RPC request requiring no special tooling.