CVE-2026-52731: ZcashFoundation zebrad denial of service via non-ASCII LongPollId in getblocktemplate

CVE-2026-52731 · Severity: medium · CVSS 6.5 · Published 2026-08-18

Zebra is a software implementation of a Zcash node used for participating in the Zcash cryptocurrency network. A vulnerability in its remote communication interface allows an authenticated user to crash the entire node by sending a specially crafted request. This can lead to service outages for mining pools and other infrastructure relying on the node, requiring a manual restart to restore operations.

Technologies: zebra-rpc (crates.io), zebrad (crates.io). Vendors: crates.io.

Quick answers

Is CVE-2026-52731 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-52731 being exploited in the wild.
How severe is CVE-2026-52731?
Medium severity, with a CVSS score of 6.5, published 18 August 2026.
Which products and versions are affected?
zebra-rpc (crates.io) <= 7.0.0, SEMVER:introduced=0,fixed=8.0.0; zebrad (crates.io) <= 4.4.1, SEMVER:introduced=0,fixed=4.5.0.
Is there a fix for CVE-2026-52731?
Yes. zebra-rpc (crates.io): upgrade to 8.0.0 or later; zebrad (crates.io): upgrade to 4.5.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-52731 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-52731?
Check whether you run zebra-rpc (crates.io) or zebrad (crates.io) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • zebra-rpc (crates.io): upgrade to 8.0.0 or later
    cargo update -p zebra-rpc
  • zebrad (crates.io): upgrade to 4.5.0 or later
    cargo update -p zebrad

Technical details

The 'getblocktemplate' RPC handler in zebrad performs fixed byte-index string slicing on the user-supplied 'LongPollId' parameter to extract tip hash and height data. Because the slicing occurs at fixed byte offsets, providing multi-byte UTF-8 (non-ASCII) characters causes the Rust runtime to panic with a 'byte index is not a char boundary' error. Since the application uses the 'panic = abort' profile, this panic terminates the entire process. The attack requires network access to the RPC port and authentication (either via the .cookie file or if cookie authentication is disabled). The issue is fixed in zebrad 4.5.0 and zebra-rpc 8.0.0 by implementing character-aware parsing.

Affected products

  • ZcashFoundation zebrad <= 4.4.1
  • ZcashFoundation zebra-rpc <= 7.0.0

Identifiers

  • CVE-2026-52731
  • GHSA-qv2r-v3mx-f4pf

Timeline

  • 2026-05-29: disclosed: Initial report to ZcashFoundation/zebra
  • 2026-07-02: advisory: GitHub Advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.