Zcash Zebra EUVD-2026-91444

Exploitation requires that (1) the zebrad node has the RPC server enabled via rpc.listen_addr set to a TCP address in zebrad.toml - this is NOT the default; and (2) the attacker can authenticate to the RPC endpoint. Under the DEFAULT enable_cookie_auth=true, authentication requires reading the local .cookie file, which generally implies local filesystem access, significantly limiting remote exploitation. Only when enable_cookie_auth=false can any network client reaching the RPC port trigger it without a credential barrier. The specific trigger is a call to the z_listunifiedreceivers RPC method with a structurally valid Unified Address whose Sapling receiver carries 43 bytes that fail Jubjub subgroup validation. Limiting factors: RPC must be explicitly enabled, cookie authentication (default) confines most attacks to local actors, and impact is availability-only (node crash) with no data exposure.

This is a moderate-priority availability issue (CVSS 4.0 base 7.1, VA:H) rather than a top-tier emergency, and the real-world signals are mixed. The CVSS 4.0 vector (AV:N/AC:L/PR:L/UI:N) indicates a low-complexity network attack requiring only low privileges, with impact limited purely to availability (VC:N/VI:N/VA:H) - no data compromise. However, the 'network + low privilege' framing understates the practical barrier: the GHSA advisory confirms that in the DEFAULT configuration (enable_cookie_auth=true), exploitation requires reading the local .cookie file, which typically means local access - so the PR:L metric is effectively satisfied only by attackers who are already local or who have been given RPC credentials. The fully remote-unauthenticated-against-network scenario only applies in the non-default enable_cookie_auth=false deployment, and only when rpc.listen_addr is set at all (RPC is a non-default opt-in). No EPSS score, KEV listing, or public POC was provided, so there is no public exploit identified at time of analysis and no evidence of active exploitation; the finding originates from VulnCheck research rather than observed attacks. Net: a genuine, easily-triggered crash bug worth patching promptly for any node operator exposing RPC, but the limited deployment footprint, availability-only impact, and the authentication/local-access gate keep this well below critical real-world urgency.

An attacker with valid RPC access to a zebrad node (either via a leaked/readable .cookie file under the default auth, or any network client if cookie auth is disabled) sends a single z_listunifiedreceivers call containing a structurally valid Unified Address whose 43-byte Sapling receiver encodes a non-subgroup Jubjub point. The handler's .expect() on the failed parse panics, and because the release profile uses panic="abort", the entire zebrad process terminates. The attacker simply replays the same request after each restart to keep the full node permanently offline. No public exploit code was identified at time of analysis.