https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-44500.htmlhttps://patchthecve.com/cve/CVE-2026-44500.htmlMon, 26 Oct 2026 18:10:00 +0000MEDIUM 5.3: ZEBRA is a Zcash node written entirely in Rust. Prior to zebrad version 4.4.0, prior to zebra-chain version 7.0.0, and prior to zebra-network version 6.0.0, several inbound deserialization paths in Zebra allocated buffers sized against generic transport or block-size ceilings before the tighter prothttps://patchthecve.com/cve/CVE-2026-41583.htmlhttps://patchthecve.com/cve/CVE-2026-41583.htmlMon, 26 Oct 2026 18:10:00 +0000CRITICAL 9.1: ZEBRA is a Zcash node written entirely in Rust. Prior to zebrad version 4.3.1 and prior to zebra-script version 5.0.2, after a refactoring, Zebra failed to validate a consensus rule that restricted the possible values of sighash hash types for V5 transactions which were enabled in the NU5 network uphttps://patchthecve.com/cve/CVE-2026-40881.htmlhttps://patchthecve.com/cve/CVE-2026-40881.htmlMon, 26 Oct 2026 21:10:00 +0000HIGH 7.5: ZEBRA is a Zcash node written entirely in Rust. Prior to zebrad version 4.3.0 and zebra-network version 5.0.1, when deserializing addr or addrv2 messages, which contain vectors of addresses, Zebra would fully deserialize them up to a maximum length (over 233,000) that was derived from the 2 MiB messhttps://patchthecve.com/cve/CVE-2026-40880.htmlhttps://patchthecve.com/cve/CVE-2026-40880.htmlMon, 26 Oct 2026 21:10:00 +0000HIGH 8.1: ZEBRA is a Zcash node written entirely in Rust. Prior to zebrad version 4.3.1 and zebra-consensus version 5.0.2, a logic error in Zebra's transaction verification cache could allow a malicious miner to induce a consensus split. By carefully submitting a transaction that is valid for height H+1 but i