GHSA-29x4-r6jv-ff4w — zebra-rpc
MEDIUMGHSA-29x4-r6jv-ff4w is a medium-severity (CVSS 6.5) CWE-248 vulnerability in zebra-rpc. A fix is available for zebra-rpc — see the affected versions and patch details below.
Zebra Vulnerable to Denial of Service via Interrupted JSON-RPC Requests from Authenticated Clients
Exploitation Status
No confirmed exploitation observed yet
- CISA’s own triage has not observed active exploitation or public proof-of-concept code for this CVE as of its last assessment.
Exploitation and automatability from CISA’s SSVC triage for GHSA-29x4-r6jv-ff4w.
EPSS Exploitation Probability
EPSS (Exploit Prediction Scoring System) is a daily probability model maintained by FIRST.org. It estimates the likelihood a CVE will be exploited in production environments within the next 30 days, derived from real-world threat intelligence signals.
How urgent is this, really
GHSA-29x4-r6jv-ff4w plotted by exploitation likelihood (EPSS) against impact (CVSS). The shaded corner — EPSS 50%+ and CVSS 7.0+ — is where this CVE doesn't sit, though severity or exploitability alone can still warrant action.
Where this sits among everything scored
Of 377,333 CVEs with a current EPSS score, this one falls in the < 10% band (highlighted). Real counts from FIRST.org, not a sample — log-scaled since the landscape is heavily right-skewed.
Real-World Exposure
zebra-rpc🦀zebradReal-time download stats are indexed for npm and PyPI packages. This vulnerability affects crates.io packages — download data is not available via public APIs for these ecosystems.
Description
A vulnerability in Zebra's JSON-RPC HTTP middleware allows an authenticated RPC client to cause a Zebra node to crash by disconnecting before the request body is fully received. The node treats the failure to read the HTTP request body as an unrecoverable error and aborts the process instead of returning an error response.
Severity
Moderate - This is a Denial of Service (DoS) that requires a client capable of passing Zebra's cookie authentication, which is enabled by default.
Affected Versions
zebrad: versions from 2.2.0 up to (but not including) 4.3.1zebra-rpc: versions from 1.0.0-beta.45 up to (but not including) 6.0.2
Description
Zebra's JSON-RPC HTTP middleware treated a failure to read the incoming HTTP request body as an unrecoverable error, aborting the process rather than returning an error response. A client that disconnected after sending only part of a request body, for example, by resetting the TCP connection mid-transfer, was sufficient to trigger the crash. The vulnerability could be exploited only by authenticated RPC clients. Nodes running the shipped defaults, with RPC bound to localhost and cookie authentication on, were not vulnerable.
Impact
Denial of Service
- Attack Vector: Network, authenticated (requires a valid RPC cookie when cookie authentication is enabled).
- Effect: Immediate crash of the Zebra node.
- Scope: Any node whose RPC interface is reachable by a client with valid credentials, or any node with cookie authentication disabled and an exposed RPC interface.
Fixed Versions
This issue is fixed in Zebra 4.3.1 (crate zebra-rpc 6.0.2).
The fix propagates failures to read the HTTP request body as ordinary error responses, so Zebra now rejects truncated or interrupted requests rather than crashing.
Mitigation
Users should upgrade to Zebra 4.3.1 or later.
If an immediate upgrade is not possible, users should ensure their RPC port is not exposed to untrusted networks and that cookie authentication remains enabled (the default).
References
Credits
Thanks to shieldedonly who discovered this issue and reported it via our coordinated disclosure process.
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 🦀crates.io | zebra-rpc | ≥ 1.0.0-beta.45&&< 6.0.2 | 6.0.2cargo update -p zebra-rpc --precise 6.0.2 |
| 🦀crates.io | zebrad | ≥ 2.2.0&&< 4.3.1 | 4.3.1cargo update -p zebrad --precise 4.3.1 |
Detection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for zebra-rpc, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update zebra-rpc to 6.0.2 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-29x4-r6jv-ff4w is resolved across your whole dependency graph.
Workarounds
If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.
How O3 protects you
O3 Security's impact-aware SCA analyses which vulnerable code paths your application actually calls, so a match like GHSA-29x4-r6jv-ff4w can be triaged on real exposure rather than presence alone.
Tailored to GHSA-29x4-r6jv-ff4w. Runtime protection reduces exposure until a permanent patch is applied and verified — it complements patching, it doesn't replace it.
Frequently Asked Questions
Is GHSA-29x4-r6jv-ff4w in your dependencies?
O3 Security finds GHSA-29x4-r6jv-ff4w across crates.io dependencies, including transitive ones, and its impact-aware SCA ranks findings by whether your code actually calls the vulnerable path.