CVE-2026-52738

Received Received - Intake

Consensus Halt in Zebra Node via Transparent Self-Spend Chain

Publication date: 2026-08-18

Last updated on: 2026-08-18

Assigner: GitHub, Inc.

Description

ZEBRA is a Zcash node written entirely in Rust. Prior to 4.5.0, a consensus-valid block containing a long chain of transparent self-spends to one address can permanently halt Zebra nodes. In zebra-state/src/service/finalized_state/zebra_db/transparent.rs, the finalized-state writer originally applied every newly created output as a credit before applying any spent-output debit from the same block. That credit-first ordering can make the intermediate per-address balance exceed MAX_MONEY even though the final net balance is valid, causing an expect-based panic under the panic equals abort release profile. Because zcashd accepts the triggering block and Zebra encounters it again after every restart, the halt persists until patched software is deployed; exploitation requires mining the specially constructed block and temporarily committing sufficient ZEC to the self-spend chain. This issue is fixed in version 4.5.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-18

Last Modified

2026-08-18

Generated

2026-08-19

AI Q&A

2026-08-19

EPSS Evaluated

N/A

NVD

CVE-2026-52738

EUVD

EUVD-2026-61167

Affected Vendors & Products

Vendor	Product	Version / Range
zcash_foundation	zebra	4.5.0
zcashfoundation	zebra	to 4.5.0 (exc)
zcashfoundation	zebra	4.4.2
zcashfoundation	zebra	to 6.0.1 (exc)
zcashfoundation	zebrad	to 4.4.1 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-248	An exception is thrown from a function, but it is not caught.

Attack-Flow Graph

Executive Summary

This vulnerability affects Zebra, a Rust-based Zcash node implementation. It involves an integer overflow in the finalized transparent address balance writer where credits (outputs) are processed before debits (inputs) in a block. A specially crafted block with many transparent self-spends to one address can cause an intermediate balance to exceed the maximum money supply cap, triggering a panic and halting the node permanently until patched.

Detection Guidance

Detecting this vulnerability requires checking the Zebra node version and monitoring for abnormal behavior. Use the command 'zebrad --version' to verify if your Zebra version is below 4.5.0. Additionally, inspect logs for repeated crashes or panics during block processing, which may indicate exploitation.

Impact Analysis

If exploited, this vulnerability can permanently halt Zebra nodes, disrupting services like light wallets, exchanges, and mining infrastructure. An attacker with mining capability and around 1,100–2,100 ZEC could cause this halt, though the funds are recovered through self-spends, making the net cost minimal.

Mitigation Strategies

Upgrade Zebra to version 4.5.0 or later immediately. There are no workarounds, so patching is the only mitigation. Ensure all nodes are updated to prevent persistent halts caused by consensus-valid malicious blocks.

Hi! I’m here to help you understand CVE-2026-52738. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70