CVE-2026-52737
Received Received - Intake

Zebra Node Remote Sync Disruption via Height Manipulation

Publication date: 2026-08-18

Last updated on: 2026-08-18

Assigner: GitHub, Inc.

Description
ZEBRA is a Zcash node written entirely in Rust. Prior to 4.5.0, a malicious unauthenticated P2P peer can answer Zebra's outbound getblocks or FindBlocks request with a small two-hash inventory and then serve a syntactically valid block whose coinbase height is far above the local chain tip. In zebrad/src/components/sync/downloads.rs, BlockDownloadVerifyError::AboveLookaheadHeightLimit originally carried only the block height and hash, so handle_block_response could not attribute the failure to the advertising peer. The error then reached the restart-worthy default path in zebrad/src/components/sync.rs, cancelling all in-flight downloads from honest peers and imposing a 67-second sync restart delay on mainnet. Because the peer was neither scored nor disconnected, the peer could repeat the cycle indefinitely with minimal bandwidth and significantly degrade synchronization without corrupting state. This issue is fixed in version 4.5.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-18
Last Modified
2026-08-18
Generated
2026-08-19
AI Q&A
2026-08-18
EPSS Evaluated
N/A
NVD
CVE-2026-52737
EUVD
EUVD-2026-61163

Affected Vendors & Products

Showing 5 associated CPEs
Vendor Product Version / Range
zebra zebra to 4.5.0 (exc)
zcashfoundation zebra 4.5.0
zcashfoundation zebra to 4.5.0 (exc)
zcashfoundation zebra_consensus 7.0.0
zcashfoundation zebra_consensus to 7.0.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-345 The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in ZEBRA, a Zcash node written in Rust, allows a malicious unauthenticated peer to exploit the sync process. The attacker sends a small inventory response to a getblocks request and then provides a block with a coinbase height far above the victim's current chain tip. This triggers an AboveLookaheadHeightLimit error, causing the entire sync process to restart globally with a 67-second delay. The attack degrades synchronization without corrupting state or requiring mining capability.

Detection Guidance

Monitor Zebra logs for repeated 'AboveLookaheadHeightLimit' errors or sync restart events. Check for peers sending blocks with coinbase heights far above your chain tip. Use network monitoring tools to detect peers repeatedly triggering sync delays.

Impact Analysis

If you run a Zcash node using ZEBRA versions before 4.5.0, this vulnerability can significantly slow down or stall your node's synchronization with the blockchain. Your node may repeatedly restart the sync process, delaying access to the latest blockchain data. The attack requires minimal resources from the attacker and can be repeated indefinitely without detection or penalty.

Mitigation Strategies

Upgrade Zebra to version 4.5.0 or later. Ensure your node rejects blocks with heights exceeding the local chain tip. Monitor peer behavior and consider blocking peers that trigger repeated sync restarts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-52737. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart