CVE-2026-52733
Received Received - Intake

Stale Sapling Orchard Subtree Roots in ZEBRA Node

Publication date: 2026-08-18

Last updated on: 2026-08-18

Assigner: GitHub, Inc.

Description
ZEBRA is a Zcash node written entirely in Rust. Prior to 4.5.0, a natural or attacker-influenced chain fork can leave stale Sapling and Orchard note-commitment subtree roots in Zebra state. In zebra-state/src/service/non_finalized_state/chain.rs, Chain::pop_tip removed a reverted tip block but did not remove subtree entries whose end_height belonged to that block, unlike the cleanup performed by pop_root. When the winning fork later finalized, the abandoned branch's stale subtree data could be written to RocksDB and survive node restarts. The corrupted history can cause z_getsubtreesbyindex consumers such as lightwalletd and light wallets to receive incorrect subtree roots, producing wallet synchronization failures or incorrect wallet state and requiring a full state rebuild for recovery. This issue is fixed in version 4.5.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-18
Last Modified
2026-08-18
Generated
2026-08-19
AI Q&A
2026-08-18
EPSS Evaluated
N/A
NVD
CVE-2026-52733
EUVD
EUVD-2026-61168

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
zebra zebra to 4.5.0 (inc)
zcash_foundation zebra 4.5.0
zcash_foundation cargo_zebra_state to 6.0.0 (inc)
zcash_foundation cargo_zebrad to 4.4.1 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-672 The product uses, accesses, or otherwise operates on a resource after that resource has been expired, released, or revoked.
CWE-459 The product does not properly "clean up" and remove temporary or supporting resources after they have been used.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-52733 is a vulnerability in ZEBRA, a Zcash node written in Rust. It occurs when a chain fork leaves stale subtree roots in Zebra state. The pop_tip function fails to remove subtree entries linked to reverted blocks, causing corrupted history to persist in RocksDB. This affects wallet synchronization and requires rebuilding the state database.

Detection Guidance

Detecting this vulnerability requires checking Zebra node versions and examining RocksDB for corrupted subtree root data. First, verify if your Zebra node version is below 4.5.0 using `cargo zebrad --version` or `cargo zebra-state --version`. If running, inspect logs for chain fork events or wallet synchronization failures. For RocksDB corruption, use RocksDB tools like `ldb` to dump and inspect subtree root entries in the database.

Impact Analysis

This vulnerability can cause wallet synchronization failures or incorrect wallet states for users relying on lightwalletd or light wallets. It may require rebuilding the state database from scratch for recovery. The impact is limited to wallet synchronization and does not affect consensus validation.

Mitigation Strategies

Upgrade to Zebra version 4.5.0 or later immediately using `cargo install --force zebrad` or similar commands. If already affected, stop the node, backup the RocksDB database, then rebuild the state database from scratch using `zebrad --rebuild-db`. Avoid using affected versions for wallet synchronization until resolved.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-52733. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart