Get real-time updates on Telegram
P5
CVE-2026-52736: zebra < 4.5.0
CVE-2026-52736. EPSS 0.0061 (percentile 0.48484), scored 21-Oct-2026.
Affected technology
zebra · < 4.5.0
ZcashFoundation
Component: Not specified by the source
Attack conditions (Vendor/CNA, CVSS 4.0): Network (remote) · No privileges required · No user interaction required
What an attacker can do
The attacker can mutate coinbase scriptSig authentication data while retaining the transaction identifiers, merkle root, and block header hash, so the poisoned body fails later commitment validation but shares the canonical hash. Vendor/CNA’s CVSS 4.0 assessment (base score 8.7/10) rates confidentiality and availability impact as none; integrity impact as high.
- CWE
- CWE-459
- CCR priority
- 0.2 /100 (P5)
- EPSS
- 0.0061 · percentile 0.48534 · 2026-10-22
- KEV
- no
Provenance
- FIRST EPSS daily exploit-probability · Source record · observed 2026-10-23 06:11:59.600832+00:00 UTC
- NVD CVE API 2.0 · Source record · observed 2026-10-23 06:11:01.814928+00:00 UTC
Stable permalink: https://cybercodered.org/item/cve-cve-2026-52736.html