Read the docs
TI-2026-37855 Aliases CVE-2026-52737GHSA-gvjc-3w7c-92jx

ZEBRA: Sync restart poisoning from single unauthenticated peer via above-lookahead block

Priority LOW 30CWE-345Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
None · None · Low
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-345.

Summary

ZEBRA is a Zcash node written entirely in Rust. Prior to 4.5.0, a malicious unauthenticated P2P peer can answer Zebra's outbound getblocks or FindBlocks request with a small two-hash inventory and then serve a syntactically valid block whose coinbase height is far above the local chain tip. In zebrad/src/components/sync/downloads.rs, BlockDownloadVerifyError::AboveLookaheadHeightLimit originally carried only the block height and hash, so handle_block_response could not attribute the failure to the advertising peer. The error then reached the restart-worthy default path in zebrad/src/components/sync.rs, cancelling all in-flight downloads from honest peers and imposing a 67-second sync restart delay on mainnet. Because the peer was neither scored nor disconnected, the peer could repeat the cycle indefinitely with minimal bandwidth and significantly degrade synchronization without corrupting state. This issue is fixed in version 4.5.0.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00262 18th percentileScored 2026-11-07
Fix Fixed zebra (ZcashFoundation): 4.5.0zebra-consensus (ZcashFoundation): 7.0.0+2 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ZcashFoundationzebrabefore 4.5.04.5.0Patch availableCNA
ZcashFoundationzebra-consensusbefore 7.0.07.0.0Patch availableCNA
—zebra-consensus (crates.io)before 7.0.07.0.0Patch availableGHSA-gvjc-3w7c-92jx
—zebrad (crates.io)before 4.5.04.5.0Patch availableGHSA-gvjc-3w7c-92jx
  • zebra VendorZcashFoundation Affected before 4.5.0 Fixed in 4.5.0 Patch available CNA
  • zebra-consensus VendorZcashFoundation Affected before 7.0.0 Fixed in 7.0.0 Patch available CNA
  • zebra-consensus (crates.io) Vendor— Affected before 7.0.0 Fixed in 7.0.0 Patch available GHSA-gvjc-3w7c-92jx
  • zebrad (crates.io) Vendor— Affected before 4.5.0 Fixed in 4.5.0 Patch available GHSA-gvjc-3w7c-92jx

Remediation

  • Fix · CNA zebra (ZcashFoundation) Fixed in 4.5.0
  • Fix · CNA zebra-consensus (ZcashFoundation) Fixed in 7.0.0
  • Fix · GHSA-gvjc-3w7c-92jx zebra-consensus (crates.io) Fixed in 7.0.0 Advisory →
  • Fix · GHSA-gvjc-3w7c-92jx zebrad (crates.io) Fixed in 4.5.0 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-52737
  2. 2026-10-03 Alias added: GHSA-gvjc-3w7c-92jx

References

Other 6

  • TI-2026-66079 Zebra before 4.4.0 Consensus Split via SIGHASH_SINGLE Missing-Output Handling CVSS 4.0HIGH 8.3
  • TI-2026-37850 ZEBRA: Mempool transaction admission denial via single-peer inbound queue saturation CVSS 3.1MEDIUM 5.3
  • TI-2026-71182 Improper block validation in Zebra gossip lets peers drop new blocks CVSS 4.0MEDIUM 6.3
  • TI-2026-29537 Zebra: addr/addrv2 Deserialization Resource Exhaustion CVSS 4.0MEDIUM 6.3
  • TI-2026-86702 Incomplete cleanup in Zebra lets peers stall initial sync CVSS 4.0HIGH 8.7
  • TI-2026-86701 Quadratic signature hashing in Zcash Zebra enables denial of service CVSS 4.0HIGH 8.7
See all 51 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences