-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

0xCERT Security Advisory 0xCERT-2026-0200
============================================================

Advisory-ID:  0xCERT-2026-0200
Severity:     Low
Published:    2026-07-02T19:34:21.000Z
Updated:      2026-10-08T22:47:31.805Z
Chains:       n/a
URL:          https://www.0xcert.com/advisory/0xCERT-2026-0200

Title: zebrad vulnerable to getblocks/getheaders locator CPU amplification via uncapped vector length

Summary
- -------
zebrad vulnerable to getblocks/getheaders locator CPU amplification via uncapped vector length. You are affected if: 1. You run zebrad up to and including v4.4.1. 2. Your node accepts inbound P2P connections. The readgetblocks and readgetheaders codec paths accepted block locator vectors up to approximately 65,535 entries (the generic TrustedPreallocate ceiling derived from MAXPROTOCOLMESSAGELEN), rather than the protocol-specification limit of 101 entries (matching zcashd's MAXLOCATORSZ).

Details
- -------
Summary
You are affected if: 1. You run zebrad up to and including v4.4.1. 2. Your node accepts inbound P2P connections. The readgetblocks and readgetheaders codec paths accepted block locator vectors up to approximately 65,535 entries (the generic TrustedPreallocate ceiling derived from MAXPROTOCOLMESSAGELEN), rather than the protocol-specification limit of 101 entries (matching zcashd's MAXLOCATORSZ).

Affected
- - zebrad (rust) < 4.5.0 — fixed in 4.5.0
- - zebra-chain (rust) < 8.0.0 — fixed in 8.0.0

Severity
Low, as rated by the upstream advisory.

Recommended actions
- - Upgrade zebrad to 4.5.0 or later
- - Upgrade zebra-chain to 8.0.0 or later

Source & attribution
This 0xCERT advisory summarises GHSA-443g-gwgp-49x4 from the GitHub Advisory Database, credited upstream to dingledropper, mpguerra, oxarbitrage: https://github.com/advisories/GHSA-443g-gwgp-49x4. Details may change; refer to the original source for the authoritative record.

References
- ----------
- - https://github.com/advisories/GHSA-443g-gwgp-49x4
- - https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-443g-gwgp-49x4
- - https://github.com/ZcashFoundation/zebra/pull/10570
- - https://github.com/ZcashFoundation/zebra/commit/8981a1b95d4807cad99e5bb3b94fc8bc723ac033

Verify with the 0xCERT OpenPGP key: https://www.0xcert.com/pgp.asc
Fingerprint: 5F94 3ED1 1E50 CF31 2128  C493 CCC7 D9EC 9415 723D

-----BEGIN PGP SIGNATURE-----

wrsEARYKAG0FgmrIRhEJEDe9Tbcr+ZxrRRQAAAAAABwAIHNhbHRAbm90YXRp
b25zLm9wZW5wZ3Bqcy5vcmf7b1G1b/hsZi8i1YSWIztD1ZRJSp6xoQ6Zt6d/
/6vrzBYhBGCkkFZbJcT5QWu27ze9Tbcr+ZxrAACj8AEA0HI2HVCNLT2hzLZ1
hjK0ytqh6gGsZzM9SsVP2t5bZoAA/RVMjFuMVIspvXoeRHGt42iHKvoteheF
Gfc2tHuPi74O
=2lAY
-----END PGP SIGNATURE-----