Offensive Security

cat /offsec/*.log

NODE: OFFSEC

Bug bounties, coordinated disclosures, and CVEs.

BOUNTIES

immunefi

CVES

assigned

DISCLOSURES

coordinated

// cve --disclosed

CVE-2026-52734mediumcvss5.9published

product: Zebra (Zcash full node)

Unbounded mempool memory leak in zebrad (<= 4.4.1): the mempool download pipeline's timeout arm returns without removing the cancel_handles entry (each up to ~2 MB) because tokio Elapsed carries no transaction id, so unauthenticated P2P traffic leaks memory without bound (~685 KB/s per connection) until the node is OOM-killed. Advisory GHSA-65jj-fmw8-468q; fixed in zebrad 4.5.0.

// vector

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

// bounty --paid

Zano

Immunefi · 2026

critical

undisclosed

Unauthenticated reset_transaction_pool admin RPC purges the entire mempool, plus an unbounded tx_pool resource-exhaustion DoS and two wallet transport/auth lows (no TLS verification, JWT replay across restart).

monero-oxide

Immunefi · 2026

medium

undisclosed

Off-by-one in wallet decoy selection omits the real output from the first RPC batch, letting an on-path node collapse an input's ring anonymity set to 1.

Utix

Immunefi · 2026

critical

undisclosed

EOA-only extcodesize == 0 withdrawal guard rejects the configured Gnosis Safe payout wallet, permanently locking 451 ETH in the deployed crowdsale.