dbcve.org
Resource Allocation Without LimitsWeakness · CWE-770

CVE-2026-44499

HIGH · 8.7 CVSS v4.0 Published 2026-05-08
Mitigation only
No fix yet — a mitigation exists. There is no fixed release. A documented workaround reduces exposure in the meantime.
See remediation →
96/100
Remediation priority · Urgent
Remotely reachable No privileges Zero-click

Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.

NVD · unedited
ZEBRA is a Zcash node written entirely in Rust. Prior to version 4.4.0, a composite denial-of-service vulnerability in Zebra's block discovery pipeline allows an unauthenticated remote attacker to permanently halt all new block discovery on a targeted node. The attack exploits three independent weaknesses in the gossip, syncer, and download subsystems — all exercisable from a single TCP connection — to create a monotonically growing block deficit that never self-heals. This issue has been patched in version 4.4.0.

Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.

dbcve analysis · moderate confidence

Zebra versions before 4.4.0 contain a composite denial-of-service vulnerability in the block discovery pipeline. An unauthenticated remote attacker can exploit three independent weaknesses in the gossip, syncer, and download subsystems via a single TCP connection to create a permanently growing block deficit that prevents self-healing, effectively halting all new block discovery on the targeted node.

MitigationUpgrade Zebra to version 4.4.0 or later to patch the vulnerability. Network isolation and traffic filtering provide limited interim protection but the primary remediation is the version upgrade.

Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.

CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.

From the vector
Attack vector
Network
Complexity
Low
Privileges
None
Authentication
X
User interaction
None
Scope
X

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.

dbcve checks

Work through these to decide whether this CVE applies to you.

  1. Determine installed Zebra version
    Run 'zebrad --version' or check the version string in the zebra binary/daemon. If using a package manager, check with 'apt list --installed | grep zebra' or 'rpm -qa | grep zebra'. Check docker image tags if running via containers.
    Affected if Version is lower than 4.4.0 (e.g., 4.3.x, 4.2.x, etc.)
  2. Verify TCP listener is exposed
    Check if Zebra is bound to a public or untrusted network interface. Review configuration files for 'listen_addr' or 'bind' settings. Use 'netstat -tlnp | grep zebra' or 'ss -tlnp | grep zebra' to see listening ports.
    Affected if Zebra TCP listeners are accessible from untrusted networks (not limited to localhost or authenticated peers only)
  3. Confirm gossip subsystem is active
    Check zebra.conf or relevant config for 'gossip' or 'peers' configuration sections. Look for 'gossip_enabled' or 'sync_peers' settings. In runtime, check if the node maintains peer connections.
    Affected if Gossip protocol is enabled and the node participates in peer-to-peer block sharing
  4. Confirm syncer/download subsystems are active
    Review configuration for 'sync' or 'download' related settings. Check if initial block download (IBD) or ongoing chain synchronization features are enabled. Look for 'state_sync' or 'block_download' configuration options.
    Affected if Block synchronization and download features are enabled (typical default configuration)
  5. Look for block deficit symptoms
    Monitor block height progression using 'zebrad getblockchaininfo' or RPC calls. Compare local block height against known network block height. Check for stalls in block discovery over time. Review logs for 'block deficit', 'sync stalled', or 'download failed' messages.
    Affected if Block height is not increasing or is significantly behind network tip despite sustained operation

A user is affected if they are running Zebra version below 4.4.0 with network exposure and the vulnerable gossip/syncer/download subsystems enabled, particularly if block discovery has stalled.

Generated from the published advisory. Verify against your own configuration.

Check your environment

Paste your version and any relevant configuration and it will be compared against the affected criteria above. Do not include secrets or credentials.

AI-assisted, checked against the advisory. Informational, not a guarantee.

Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.

dbcve · scoped
Mitigation available No clean upgrade yet — mitigate in the meantime
Mitigation

Upgrade Zebra to version 4.4.0 or later to patch the vulnerability. Network isolation and traffic filtering provide limited interim protection but the primary remediation is the version upgrade.

Recommended fix Moderate confidence

4.4.0

  1. 1. Back up your Zebra node data and configuration files before upgrading
  2. 2. Stop the Zebra node service
  3. 3. Update your package manager or download the latest Zebra release from the official repository
  4. 4. Upgrade to version 4.4.0 or later
  5. 5. Verify the upgrade by checking the Zebra version (e.g., `zebrad --version`)
  6. 6. Restart the Zebra node service
  7. 7. Monitor the node's block synchronization to ensure normal operation
Caveat Review Zebra 4.4.0 release notes for any configuration or consensus changes before upgrading

Generated from the published advisory — verify against the referenced sources before acting.

Have this fixed Scoped from the published advisory
  • Consultation3.0 h
  • Implementation4.0 h
  • Testing4.0 h
  • Review / QA2.0 h
13.0 hours of engineering $2,280
Get help mitigating

An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $3,648.

Scan for this in your stack

Free · runs locally
dbcve dependency scanner

Check whether your project pulls in CVE-2026-44499 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.

Get it on GitHub Scan in the browser

References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.

Primary sources

Practitioner notes

Contributed

Peer-ranked notes from engineers who’ve handled CVE-2026-44499 in production — separate from our analysis above.

No notes yet

Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.

What this is

A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.

What belongs here
  • Verified mitigations, workarounds, and config changes
  • Version or environment caveats, and links to real fixes
  • No weaponised exploit code, or anything meant to cause harm
  • No spam, self-promotion, credentials, or personal data