CVE-2026-52733: ZcashFoundation zebrad persistent state corruption in subtree roots

CVE-2026-52733 · Severity: medium · CVSS 6.5 · Published 2026-08-18

Zebra, a Zcash node implementation, contains a flaw that causes permanent data corruption when the blockchain undergoes a 'fork' (a common event where multiple miners find blocks simultaneously). This corruption affects the records used by mobile and light wallets to synchronize their balances, potentially leading to incorrect wallet states or synchronization failures. Fixing the issue requires node operators to update their software and completely rebuild their local blockchain database.

Technologies: zebra-state (crates.io), zebrad (crates.io). Vendors: crates.io.

Quick answers

Is CVE-2026-52733 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-52733 being exploited in the wild.
How severe is CVE-2026-52733?
Medium severity, with a CVSS score of 6.5, published 18 August 2026.
Which products and versions are affected?
zebra-state (crates.io) <= 6.0.0, SEMVER:introduced=0,fixed=7.0.0; zebrad (crates.io) <= 4.4.1, SEMVER:introduced=0,fixed=4.5.0.
Is there a fix for CVE-2026-52733?
Yes. zebra-state (crates.io): upgrade to 7.0.0 or later; zebrad (crates.io): upgrade to 4.5.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-52733 attacked?
It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-52733?
Check whether you run zebra-state (crates.io) or zebrad (crates.io) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • zebra-state (crates.io): upgrade to 7.0.0 or later
    cargo update -p zebra-state
  • zebrad (crates.io): upgrade to 4.5.0 or later
    cargo update -p zebrad

Technical details

A logic asymmetry exists between the 'pop_root' and 'pop_tip' methods in the non-finalized state management of Zebra. While 'pop_root' correctly handles finalization cleanup, 'pop_tip' fails to remove note commitment subtree root contributions when a block is reverted during a chain fork. This stale in-memory data is subsequently written to the persistent RocksDB state during the next finalization event. The resulting corruption affects the 'z_getsubtreesbyindex' RPC, causing downstream consumers like lightwalletd to receive incorrect data. The vulnerability is tracked as CWE-459 (Incomplete Cleanup) and requires a full state rebuild to remediate existing corruption.

Affected products

  • ZcashFoundation zebrad <= 4.4.1
  • ZcashFoundation zebra-state <= 6.0.0

Identifiers

  • CVE-2026-52733
  • GHSA-2gf8-q9rr-jq3h

Timeline

  • 2026-05-29: disclosed: Private submission via GitHub Security Advisory
  • 2026-07-02: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.