CVE-2026-52731: ZEBRA is a Zcash node written entirely in Rust. Prior to 4.5.0, an attacker authenticated to an enabled Zebra RPC endpoint can terminate zeb

Executive brief

Zebra is a software implementation of a Zcash node used for participating in the Zcash cryptocurrency network. A vulnerability in its remote communication interface allows an authenticated user to crash the entire node by sending a specially crafted request. This can lead to service outages for mining pools and other infrastructure relying on the node, requiring a manual restart to restore operations.

Technical details

The 'getblocktemplate' RPC handler in zebrad performs fixed byte-index string slicing on the user-supplied 'LongPollId' parameter to extract tip hash and height data. Because the slicing occurs at fixed byte offsets, providing multi-byte UTF-8 (non-ASCII) characters causes the Rust runtime to panic with a 'byte index is not a char boundary' error. Since the application uses the 'panic = abort' profile, this panic terminates the entire process. The attack requires network access to the RPC port and authentication (either via the .cookie file or if cookie authentication is disabled). The issue is fixed in zebrad 4.5.0 and zebra-rpc 8.0.0 by implementing character-aware parsing.

Affected products

• ZcashFoundation zebrad <= 4.4.1
• ZcashFoundation zebra-rpc <= 7.0.0

Timeline

• 2026-05-29: disclosed: Initial report to ZcashFoundation/zebra
• 2026-07-02: advisory: GitHub Advisory published

References

• https://api.github.com/users/sangsoo-osec
• https://github.com/sangsoo-osec
• https://api.github.com/users/sangsoo-osec/gists%7B/gist_id%7D
• https://api.github.com/users/sangsoo-osec/repos
• https://avatars.githubusercontent.com/u/129559837?v=4
• https://api.github.com/users/sangsoo-osec/events%7B/privacy%7D