Zebra (Zcash node) CVE-2026-41585

Zebra is a Zcash blockchain node implementation written in Rust. The vulnerability resides in the JSON-RPC HTTP middleware layer that handles incoming RPC requests over HTTP. The root cause is CWE-248 (Uncaught Exception), where the middleware fails to properly handle exceptions or error conditions when reading the incoming HTTP request body. When a client disconnects or resets the TCP connection before transmitting the complete request body, the middleware's HTTP request parsing logic encounters a read failure. Rather than gracefully handling this I/O error and returning an HTTP error response (e.g., 400 Bad Request), the middleware treats it as an unrecoverable fatal error and calls process abort(), immediately terminating the entire Zebra node. This affects both the standalone zebrad binary (versions 2.2.0-4.3.0) and the zebra-rpc crate library (versions 1.0.0-beta.45-6.0.1) which provide the HTTP middleware implementation.