CVE-2026-52739
Received Received - Intake

Zebra Node Denial of Service via Duplicate Shielded Transaction

Publication date: 2026-08-18

Last updated on: 2026-08-18

Assigner: GitHub, Inc.

Description
ZEBRA is a Zcash node written entirely in Rust. Prior to 4.5.0, a malicious block producer can terminate zebrad by placing the same shielded transaction in a non-finalized parent block and its child. In zebra-state/src/service/non_finalized_state/chain.rs, Chain::push originally inserted the transaction hash into tx_loc_by_hash and asserted uniqueness before updating shielded data and running the duplicate Sprout, Sapling, or Orchard nullifier checks. The repeated transaction therefore reached the transactions must be unique within a single chain assertion before contextual validation could reject it cleanly. Zebra release builds use panic equals abort, so the reachable assertion terminates the entire process; exploitation requires either two consecutive attacker-mined blocks or an attacker-mined child immediately after an honest block includes the attacker's shielded transaction. This issue is fixed in version 4.5.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-18
Last Modified
2026-08-18
Generated
2026-08-19
AI Q&A
2026-08-18
EPSS Evaluated
N/A
NVD
CVE-2026-52739
EUVD
EUVD-2026-61165

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
zebra zebrad 4.5.0
zcashfoundation zebrad to 4.5.0 (exc)
zcashfoundation zebra-state to 6.0.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-248 An exception is thrown from a function, but it is not caught.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in ZEBRA, a Zcash node written in Rust, allows a malicious block producer to crash the zebrad process by including the same shielded transaction in both a parent block and its child block. The issue occurs because the transaction hash is inserted before duplicate checks are performed, leading to an assertion failure that terminates the process due to panic equals abort in release builds.

Detection Guidance

This vulnerability can be detected by checking the ZEBRA node version. If your system is running a version prior to 4.5.0, it is vulnerable. Use the command 'zebrad --version' to check the installed version.

Impact Analysis

If exploited, this vulnerability can cause the ZEBRA node to crash, disrupting the operation of the Zcash network. This may lead to downtime, loss of service, or reduced reliability for users relying on the node. Exploitation requires the attacker to control consecutive blocks or have their transaction included in a block immediately after an honest block.

Mitigation Strategies

Upgrade ZEBRA to version 4.5.0 or later immediately to address the vulnerability. This version includes the fix for the assertion issue that could terminate the zebrad process.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-52739. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart