Search
Find a vulnerability
Search criteria
4 vulnerabilities by zcash
CVE-2026-54496 (GCVE-0-2026-54496)
Vulnerability from nvd – Published: 2026-07-17 16:59 – Updated: 2026-07-17 17:23
VLAI
EPSS
VEX
Title
Missing copy constraint in halo2_gadgets variable-base scalar multiplication allows under-constrained base, breaking Orchard Action circuit soundness
Summary
ZEBRA is a Zcash node written entirely in Rust. Prior to zebrad 5.0.0, halo2_gadgets 0.5.0, orchard 0.14.0, zcash_primitives 0.28.0, and zcashd 6.20.0, the variable-base scalar multiplication gadget in halo2_gadgets/src/ecc/chip/mul/incomplete.rs used assign_advice() for the base point without a copy constraint tying it to the actual base, allowing a malicious prover to produce a valid proof for an Orchard Action with an under-constrained base point and bypass the diversified-address-integrity check that binds pk_d, g_d, ivk, the nullifier (nf), and the spend validating key (ak) to the note being spent. This issue is fixed in zebrad 5.0.0, halo2_gadgets 0.5.0, orchard 0.14.0, zcash_primitives 0.28.0, and zcashd 6.20.0.
Severity
9.3 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-345 - Insufficient Verification of Data Authenticity
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://github.com/ZcashFoundation/zebra/security… | x_refsource_CONFIRM |
| https://github.com/ZcashFoundation/zebra/releases… | x_refsource_MISC |
| https://github.com/zcash/halo2/releases/tag/halo2… | x_refsource_MISC |
| https://github.com/zcash/librustzcash/releases/ta… | x_refsource_MISC |
| https://github.com/zcash/orchard/releases/tag/0.14.0 | x_refsource_MISC |
| https://github.com/zcash/zcash/releases/tag/v6.20.0 | x_refsource_MISC |
| https://zfnd.org/zebra-4-5-3-and-5-0-0-emergency-… | x_refsource_MISC |
Impacted products
5 products
| Vendor | Product | Version | |
|---|---|---|---|
| ZcashFoundation | zebra |
Affected:
< 5.0.0
|
|
| zcash | halo2_gadgets |
Affected:
< 0.5.0
|
|
| zcash | orchard |
Affected:
< 0.14.0
|
|
| zcash | librustzcash |
Affected:
< 0.28.0
|
|
| zcash | zcash |
Affected:
< 6.20.0
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-54496",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-17T17:23:34.445671Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-17T17:23:50.731Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "zebra",
"vendor": "ZcashFoundation",
"versions": [
{
"status": "affected",
"version": "\u003c 5.0.0"
}
]
},
{
"product": "halo2_gadgets",
"vendor": "zcash",
"versions": [
{
"status": "affected",
"version": "\u003c 0.5.0"
}
]
},
{
"product": "orchard",
"vendor": "zcash",
"versions": [
{
"status": "affected",
"version": "\u003c 0.14.0"
}
]
},
{
"product": "librustzcash",
"vendor": "zcash",
"versions": [
{
"status": "affected",
"version": "\u003c 0.28.0"
}
]
},
{
"product": "zcash",
"vendor": "zcash",
"versions": [
{
"status": "affected",
"version": "\u003c 6.20.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "ZEBRA is a Zcash node written entirely in Rust. Prior to zebrad 5.0.0, halo2_gadgets 0.5.0, orchard 0.14.0, zcash_primitives 0.28.0, and zcashd 6.20.0, the variable-base scalar multiplication gadget in halo2_gadgets/src/ecc/chip/mul/incomplete.rs used assign_advice() for the base point without a copy constraint tying it to the actual base, allowing a malicious prover to produce a valid proof for an Orchard Action with an under-constrained base point and bypass the diversified-address-integrity check that binds pk_d, g_d, ivk, the nullifier (nf), and the spend validating key (ak) to the note being spent. This issue is fixed in zebrad 5.0.0, halo2_gadgets 0.5.0, orchard 0.14.0, zcash_primitives 0.28.0, and zcashd 6.20.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-345",
"description": "CWE-345: Insufficient Verification of Data Authenticity",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-17T16:59:06.809Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-ww9q-8r59-xv46",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-ww9q-8r59-xv46"
},
{
"name": "https://github.com/ZcashFoundation/zebra/releases/tag/v5.0.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/ZcashFoundation/zebra/releases/tag/v5.0.0"
},
{
"name": "https://github.com/zcash/halo2/releases/tag/halo2_gadgets-0.5.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/zcash/halo2/releases/tag/halo2_gadgets-0.5.0"
},
{
"name": "https://github.com/zcash/librustzcash/releases/tag/zcash_primitives-0.28.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/zcash/librustzcash/releases/tag/zcash_primitives-0.28.0"
},
{
"name": "https://github.com/zcash/orchard/releases/tag/0.14.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/zcash/orchard/releases/tag/0.14.0"
},
{
"name": "https://github.com/zcash/zcash/releases/tag/v6.20.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/zcash/zcash/releases/tag/v6.20.0"
},
{
"name": "https://zfnd.org/zebra-4-5-3-and-5-0-0-emergency-soft-fork-and-nu6-2-activation",
"tags": [
"x_refsource_MISC"
],
"url": "https://zfnd.org/zebra-4-5-3-and-5-0-0-emergency-soft-fork-and-nu6-2-activation"
}
],
"source": {
"advisory": "GHSA-ww9q-8r59-xv46",
"discovery": "UNKNOWN"
},
"title": "Missing copy constraint in halo2_gadgets variable-base scalar multiplication allows under-constrained base, breaking Orchard Action circuit soundness"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-54496",
"datePublished": "2026-07-17T16:59:06.809Z",
"dateReserved": "2026-06-15T18:01:15.511Z",
"dateUpdated": "2026-07-17T17:23:50.731Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-35679 (GCVE-0-2026-35679)
Vulnerability from nvd – Published: 2026-04-05 21:26 – Updated: 2026-04-06 14:04
VLAI
EPSS
VEX
Summary
Zcash zcashd before 6.12.0 allows invalid transactions to be accepted under certain conditions, which potentially could have resulted in the draining of user funds from the Sprout pool. It was sometimes not verifying Sprout proofs.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-358 - Improperly Implemented Security Check for Standard
Assigner
References
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-35679",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-04-06T14:03:56.794856Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-04-06T14:04:35.190Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "zcashd",
"vendor": "Zcash",
"versions": [
{
"lessThan": "6.12.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Zcash zcashd before 6.12.0 allows invalid transactions to be accepted under certain conditions, which potentially could have resulted in the draining of user funds from the Sprout pool. It was sometimes not verifying Sprout proofs."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 3.5,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-358",
"description": "CWE-358 Improperly Implemented Security Check for Standard",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-05T21:31:46.130Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://github.com/zcash/zcash/releases/tag/v6.12.0"
},
{
"url": "https://github.com/zcash/zcash/commit/db969c63f48f0f9fc518112ed0b7ace1af78b9d0"
}
],
"x_generator": {
"engine": "CVE-Request-form 0.0.1"
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2026-35679",
"datePublished": "2026-04-05T21:26:58.622Z",
"dateReserved": "2026-04-05T21:26:58.043Z",
"dateUpdated": "2026-04-06T14:04:35.190Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-54496 (GCVE-0-2026-54496)
Vulnerability from cvelistv5 – Published: 2026-07-17 16:59 – Updated: 2026-07-17 17:23
VLAI
EPSS
VEX
Title
Missing copy constraint in halo2_gadgets variable-base scalar multiplication allows under-constrained base, breaking Orchard Action circuit soundness
Summary
ZEBRA is a Zcash node written entirely in Rust. Prior to zebrad 5.0.0, halo2_gadgets 0.5.0, orchard 0.14.0, zcash_primitives 0.28.0, and zcashd 6.20.0, the variable-base scalar multiplication gadget in halo2_gadgets/src/ecc/chip/mul/incomplete.rs used assign_advice() for the base point without a copy constraint tying it to the actual base, allowing a malicious prover to produce a valid proof for an Orchard Action with an under-constrained base point and bypass the diversified-address-integrity check that binds pk_d, g_d, ivk, the nullifier (nf), and the spend validating key (ak) to the note being spent. This issue is fixed in zebrad 5.0.0, halo2_gadgets 0.5.0, orchard 0.14.0, zcash_primitives 0.28.0, and zcashd 6.20.0.
Severity
9.3 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-345 - Insufficient Verification of Data Authenticity
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://github.com/ZcashFoundation/zebra/security… | x_refsource_CONFIRM |
| https://github.com/ZcashFoundation/zebra/releases… | x_refsource_MISC |
| https://github.com/zcash/halo2/releases/tag/halo2… | x_refsource_MISC |
| https://github.com/zcash/librustzcash/releases/ta… | x_refsource_MISC |
| https://github.com/zcash/orchard/releases/tag/0.14.0 | x_refsource_MISC |
| https://github.com/zcash/zcash/releases/tag/v6.20.0 | x_refsource_MISC |
| https://zfnd.org/zebra-4-5-3-and-5-0-0-emergency-… | x_refsource_MISC |
Impacted products
5 products
| Vendor | Product | Version | |
|---|---|---|---|
| ZcashFoundation | zebra |
Affected:
< 5.0.0
|
|
| zcash | halo2_gadgets |
Affected:
< 0.5.0
|
|
| zcash | orchard |
Affected:
< 0.14.0
|
|
| zcash | librustzcash |
Affected:
< 0.28.0
|
|
| zcash | zcash |
Affected:
< 6.20.0
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-54496",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-17T17:23:34.445671Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-17T17:23:50.731Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "zebra",
"vendor": "ZcashFoundation",
"versions": [
{
"status": "affected",
"version": "\u003c 5.0.0"
}
]
},
{
"product": "halo2_gadgets",
"vendor": "zcash",
"versions": [
{
"status": "affected",
"version": "\u003c 0.5.0"
}
]
},
{
"product": "orchard",
"vendor": "zcash",
"versions": [
{
"status": "affected",
"version": "\u003c 0.14.0"
}
]
},
{
"product": "librustzcash",
"vendor": "zcash",
"versions": [
{
"status": "affected",
"version": "\u003c 0.28.0"
}
]
},
{
"product": "zcash",
"vendor": "zcash",
"versions": [
{
"status": "affected",
"version": "\u003c 6.20.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "ZEBRA is a Zcash node written entirely in Rust. Prior to zebrad 5.0.0, halo2_gadgets 0.5.0, orchard 0.14.0, zcash_primitives 0.28.0, and zcashd 6.20.0, the variable-base scalar multiplication gadget in halo2_gadgets/src/ecc/chip/mul/incomplete.rs used assign_advice() for the base point without a copy constraint tying it to the actual base, allowing a malicious prover to produce a valid proof for an Orchard Action with an under-constrained base point and bypass the diversified-address-integrity check that binds pk_d, g_d, ivk, the nullifier (nf), and the spend validating key (ak) to the note being spent. This issue is fixed in zebrad 5.0.0, halo2_gadgets 0.5.0, orchard 0.14.0, zcash_primitives 0.28.0, and zcashd 6.20.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-345",
"description": "CWE-345: Insufficient Verification of Data Authenticity",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-17T16:59:06.809Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-ww9q-8r59-xv46",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-ww9q-8r59-xv46"
},
{
"name": "https://github.com/ZcashFoundation/zebra/releases/tag/v5.0.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/ZcashFoundation/zebra/releases/tag/v5.0.0"
},
{
"name": "https://github.com/zcash/halo2/releases/tag/halo2_gadgets-0.5.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/zcash/halo2/releases/tag/halo2_gadgets-0.5.0"
},
{
"name": "https://github.com/zcash/librustzcash/releases/tag/zcash_primitives-0.28.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/zcash/librustzcash/releases/tag/zcash_primitives-0.28.0"
},
{
"name": "https://github.com/zcash/orchard/releases/tag/0.14.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/zcash/orchard/releases/tag/0.14.0"
},
{
"name": "https://github.com/zcash/zcash/releases/tag/v6.20.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/zcash/zcash/releases/tag/v6.20.0"
},
{
"name": "https://zfnd.org/zebra-4-5-3-and-5-0-0-emergency-soft-fork-and-nu6-2-activation",
"tags": [
"x_refsource_MISC"
],
"url": "https://zfnd.org/zebra-4-5-3-and-5-0-0-emergency-soft-fork-and-nu6-2-activation"
}
],
"source": {
"advisory": "GHSA-ww9q-8r59-xv46",
"discovery": "UNKNOWN"
},
"title": "Missing copy constraint in halo2_gadgets variable-base scalar multiplication allows under-constrained base, breaking Orchard Action circuit soundness"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-54496",
"datePublished": "2026-07-17T16:59:06.809Z",
"dateReserved": "2026-06-15T18:01:15.511Z",
"dateUpdated": "2026-07-17T17:23:50.731Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-35679 (GCVE-0-2026-35679)
Vulnerability from cvelistv5 – Published: 2026-04-05 21:26 – Updated: 2026-04-06 14:04
VLAI
EPSS
VEX
Summary
Zcash zcashd before 6.12.0 allows invalid transactions to be accepted under certain conditions, which potentially could have resulted in the draining of user funds from the Sprout pool. It was sometimes not verifying Sprout proofs.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-358 - Improperly Implemented Security Check for Standard
Assigner
References
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-35679",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-04-06T14:03:56.794856Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-04-06T14:04:35.190Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "zcashd",
"vendor": "Zcash",
"versions": [
{
"lessThan": "6.12.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Zcash zcashd before 6.12.0 allows invalid transactions to be accepted under certain conditions, which potentially could have resulted in the draining of user funds from the Sprout pool. It was sometimes not verifying Sprout proofs."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 3.5,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-358",
"description": "CWE-358 Improperly Implemented Security Check for Standard",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-05T21:31:46.130Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://github.com/zcash/zcash/releases/tag/v6.12.0"
},
{
"url": "https://github.com/zcash/zcash/commit/db969c63f48f0f9fc518112ed0b7ace1af78b9d0"
}
],
"x_generator": {
"engine": "CVE-Request-form 0.0.1"
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2026-35679",
"datePublished": "2026-04-05T21:26:58.622Z",
"dateReserved": "2026-04-05T21:26:58.043Z",
"dateUpdated": "2026-04-06T14:04:35.190Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}