ETK-2026-2302Zero's internal tracking ID, independent of the CVE number.

{
  "etk_id": "ETK-2026-2302",
  "cve_id": null,
  "display_id": "ETK-2026-2302",
  "ghsa_id": "GHSA-mm9x-928m-8gjc",
  "euvd_id": null,
  "status": "published",
  "anchor_state": "awaiting_cve",
  "title": "Payer-triggered panic in tari_ootle_wallet_crypto",
  "summary": "tari_ootle_wallet_crypto can panic when processing a confidential output containing a non-canonical mask encoding. A payer able to submit a confidential transfer to a recipient's public address can cause receiving wallet software, including walletd, to stop and repeatedly fail during later scans.",
  "mitigation": "No fixed version is recorded. Reduce exposure by restricting untrusted confidential transfers where feasible and use recovery tooling that can remove the offending output or reset the affected wallet state without unblinding it.",
  "vendor": "rust",
  "product": "rust:tari_ootle_wallet_crypto",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        "<= 0.47.0"
      ],
      "ecosystem": "rust",
      "fixed_versions": [],
      "package_name": "tari_ootle_wallet_crypto",
      "purl": "pkg:cargo/tari_ootle_wallet_crypto"
    }
  ],
  "cwes": [
    400
  ],
  "cvss_score": 8.7,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 16.235020833333333,
  "t0_at": null,
  "signals": {
    "public_poc": {
      "at": "2026-10-20T11:10:51+00:00",
      "days": -0.942678975625,
      "is_lower_bound": true,
      "measured_at": "2026-10-21T09:48:18.541109+00:00",
      "url": "https://github.com/tari-project/tari-ootle/security/advisories/GHSA-mm9x-928m-8gjc"
    },
    "trigger_signal": {
      "at": "2026-10-20T11:10:51+00:00",
      "days": -0.942678975625,
      "is_lower_bound": true,
      "measured_at": "2026-10-21T09:48:18.541109+00:00",
      "url": "https://github.com/tari-project/tari-ootle/security/advisories/GHSA-mm9x-928m-8gjc"
    }
  }
}