ZEBRA: Full node denial of service via non-ASCII LongPollId in getblocktemplate
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-248.
Summary
ZEBRA is a Zcash node written entirely in Rust. Prior to 4.5.0, an attacker authenticated to an enabled Zebra RPC endpoint can terminate zebrad by supplying a getblocktemplate LongPollId containing multi-byte UTF-8 characters. In zebra-rpc/src/methods/types/long_poll.rs, LongPollId::from_str originally checked the input byte length and then sliced fixed byte ranges to parse encoded fields. A slice boundary can land inside a multi-byte character and trigger Rust's byte index is not a char boundary panic. Zebra release builds use panic equals abort, so one malformed authenticated RPC request terminates the entire node process and can be repeated after restart. This issue is fixed in version 4.5.0.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| ZcashFoundation | zebra | before 4.5.0 | 4.5.0 | Patch available | CNA |
| ZcashFoundation | zebra-rpc | before 8.0.0 | 8.0.0 | Patch available | CNA |
| — | zebra-rpc (crates.io) | before 8.0.0 | 8.0.0 | Patch available | GHSA-qv2r-v3mx-f4pf |
| — | zebrad (crates.io) | before 4.5.0 | 4.5.0 | Patch available | GHSA-qv2r-v3mx-f4pf |
- zebra VendorZcashFoundation Affected before 4.5.0 Fixed in 4.5.0 Patch available CNA
- zebra-rpc VendorZcashFoundation Affected before 8.0.0 Fixed in 8.0.0 Patch available CNA
- zebra-rpc (crates.io) Vendor— Affected before 8.0.0 Fixed in 8.0.0 Patch available GHSA-qv2r-v3mx-f4pf
- zebrad (crates.io) Vendor— Affected before 4.5.0 Fixed in 4.5.0 Patch available GHSA-qv2r-v3mx-f4pf
Remediation
- Fix · CNA zebra (ZcashFoundation) Fixed in 4.5.0
- Fix · CNA zebra-rpc (ZcashFoundation) Fixed in 8.0.0
- Fix · GHSA-qv2r-v3mx-f4pf zebra-rpc (crates.io) Fixed in 8.0.0 Advisory →
- Fix · GHSA-qv2r-v3mx-f4pf zebrad (crates.io) Fixed in 4.5.0 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2026-52731
- 2026-10-03 Alias added: GHSA-qv2r-v3mx-f4pf
References
Other 5
- https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-qv2r-v3mx-f4pf
- https://github.com/ZcashFoundation/zebra/commit/1440b43ca7df59aca948090d45117557b217a6cd
- https://github.com/ZcashFoundation/zebra/releases/tag/v4.5.0
- https://github.com/ZcashFoundation/zebra
- https://github.com/ZcashFoundation/zebra/blob/d4cd662c716382f6397d2a730148025a1ca79fec/Cargo.toml#L305
More ZcashFoundation vulnerabilities
- TI-2026-66079 Zebra before 4.4.0 Consensus Split via SIGHASH_SINGLE Missing-Output Handling CVSS 4.0HIGH 8.3
- TI-2026-37850 ZEBRA: Mempool transaction admission denial via single-peer inbound queue saturation CVSS 3.1MEDIUM 5.3
- TI-2026-71182 Improper block validation in Zebra gossip lets peers drop new blocks CVSS 4.0MEDIUM 6.3
- TI-2026-29537 Zebra: addr/addrv2 Deserialization Resource Exhaustion CVSS 4.0MEDIUM 6.3
- TI-2026-86702 Incomplete cleanup in Zebra lets peers stall initial sync CVSS 4.0HIGH 8.7
- TI-2026-86701 Quadratic signature hashing in Zcash Zebra enables denial of service CVSS 4.0HIGH 8.7
Sources
- CVE-2026-52731 · CVE Program
- CVE-2026-52731 · NVD
- FIRST EPSS
- GHSA-qv2r-v3mx-f4pf · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences