CVE-2026-52739
MediumCVSS 5.9Exploitation Probability (EPSS)
Low risk33th percentile - higher than 33% of all known CVEs
Summary
ZEBRA prior to 4.5.0 can be terminated by a malicious block producer by placing the same shielded transaction in a non-finalized parent block and its child. The uniqueness assertion is reachable before contextual validation, and release builds use panic=abort, terminating the process.
Risk Assessment
The risk includes intentional halting of Zebra nodes, potentially leading to network disruptions and loss of synchronization.
Recommendation
Upgrade ZEBRA to version 4.5.0 or later and monitor for suspicious blocks.
Original NVD description (English source)
ZEBRA is a Zcash node written entirely in Rust. Prior to 4.5.0, a malicious block producer can terminate zebrad by placing the same shielded transaction in a non-finalized parent block and its child. In zebra-state/src/service/non_finalized_state/chain.rs, Chain::push originally inserted the transaction hash into tx_loc_by_hash and asserted uniqueness before updating shielded data and running the duplicate Sprout, Sapling, or Orchard nullifier checks. The repeated transaction therefore reached the transactions must be unique within a single chain assertion before contextual validation could reject it cleanly. Zebra release builds use panic equals abort, so the reachable assertion terminates the entire process; exploitation requires either two consecutive attacker-mined blocks or an attacker-mined child immediately after an honest block includes the attacker's shielded transaction. This issue is fixed in version 4.5.0.