Zebra has rk Identity Point Panic in Transaction Verification
Zebra has rk Identity Point Panic in Transaction Verification. Orchard transactions contain a rk field which is a randomized validating key and also an elliptic curve point. The Zcash specification allows the field to be the identity (a "zero" value), however, the orchard crate which is used to verify Orchard proofs would panic when fed a rk with the identity value.
Vuln-watch · relayed from the GitHub Advisory Database; see Source & attribution below
Summary
Orchard transactions contain a rk field which is a randomized validating key and also an elliptic curve point. The Zcash specification allows the field to be the identity (a "zero" value), however, the orchard crate which is used to verify Orchard proofs would panic when fed a rk with the identity value.
Affected
- zebrad (rust) < 4.3.1 — fixed in 4.3.1
- zebra-chain (rust) < 6.0.2 — fixed in 6.0.2
Severity
Critical (CVSS 9.2), as rated by the upstream advisory.
Recommended actions
- Upgrade zebrad to 4.3.1 or later
- Upgrade zebra-chain to 6.0.2 or later
Source & attribution
This 0xCERT advisory summarises GHSA-452v-w3gx-72wg / CVE-2026-41584 from the GitHub Advisory Database, credited upstream to conradoplg, mpguerra: https://github.com/advisories/GHSA-452v-w3gx-72wg. Details may change; refer to the original source for the authoritative record.
References
OpenPGP-signed. The signed text of this advisory verifies against the 0xCERT key CCC7 D9EC 9415 723D.
Published 2026-04-18 · last updated 2026-10-08
curl -s https://www.0xcert.com/pgp.asc | gpg --import && curl -s https://www.0xcert.com/advisory/0xCERT-2026-0228/signed.txt | gpg --verify