CVE-2026-52731

Received Received - Intake

Zebra Node DoS via Malformed LongPollId in RPC

Publication date: 2026-08-18

Last updated on: 2026-08-18

Assigner: GitHub, Inc.

Description

ZEBRA is a Zcash node written entirely in Rust. Prior to 4.5.0, an attacker authenticated to an enabled Zebra RPC endpoint can terminate zebrad by supplying a getblocktemplate LongPollId containing multi-byte UTF-8 characters. In zebra-rpc/src/methods/types/long_poll.rs, LongPollId::from_str originally checked the input byte length and then sliced fixed byte ranges to parse encoded fields. A slice boundary can land inside a multi-byte character and trigger Rust's byte index is not a char boundary panic. Zebra release builds use panic equals abort, so one malformed authenticated RPC request terminates the entire node process and can be repeated after restart. This issue is fixed in version 4.5.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-18

Last Modified

2026-08-18

Generated

2026-08-19

AI Q&A

2026-08-19

EPSS Evaluated

N/A

NVD

CVE-2026-52731

EUVD

EUVD-2026-61169

Affected Vendors & Products

Vendor	Product	Version / Range
zebra	zebra	to 4.5.0 (inc)
zcash_foundation	zebra	4.5.0
zcash_foundation	zebra	to 4.5.0 (exc)
zcash_foundation	zebra_rpc	to 8.0.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-248	An exception is thrown from a function, but it is not caught.

Attack-Flow Graph

Executive Summary

This is a denial of service vulnerability in Zebra, a Zcash node written in Rust. An attacker authenticated to an enabled Zebra RPC endpoint can crash the zebrad process by sending a maliciously crafted getblocktemplate LongPollId parameter containing multi-byte UTF-8 characters. The issue occurs because the LongPollId parsing logic incorrectly slices string boundaries, triggering a Rust panic that terminates the node due to panic=abort in release builds.

Detection Guidance

Monitor for unexpected termination of zebrad processes after receiving RPC requests with non-ASCII characters in the LongPollId field. Check logs for panic errors related to byte index boundaries in string parsing.

Impact Analysis

If you run a Zebra node version 4.4.1 or earlier, an attacker with RPC access could repeatedly crash your node, causing downtime and disrupting Zcash network operations. The attack requires authenticated RPC access, which may be possible via cookie file compromise or if enable_cookie_auth is disabled and the RPC server is exposed to the network.

Mitigation Strategies

Update Zebra to version 4.5.0 or later to patch the vulnerability.
Disable the RPC server if not needed or restrict access via cookie authentication.
Use a reverse proxy to filter non-ASCII inputs in RPC requests.

Hi! I’m here to help you understand CVE-2026-52731. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70