AIKIDO-2026-760287
zebra-rpc is vulnerable to Denial of Service (DoS)
53
Medium Risk
This Affects:
zebra-rpcTL;DR
The verbosity-2 branch of the getblock RPC builds each transaction object by converting the block's confirmations value into an unsigned integer with an unchecked expectation. For a block that is not on the best chain the confirmations value is a negative sentinel, so the conversion fails and the process aborts because the build treats panics as aborts. A caller that can reach getblock, including indirectly through lightwalletd, can crash the node with a single verbosity-2 call against a side-chain block and repeat it to keep the node down. The fix carries the confirmations value without the failing narrowing conversion.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you expose the getblock RPC to untrusted input, directly or through lightwalletd.
Background info
zebra-rpc is vulnerable to Denial of Service (DoS) in versions 0.0.1 - 10.0.1.
How to fix this
Upgrade the zebra-rpc library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant