# CVE-2026-52733: ZcashFoundation zebrad persistent state corruption in subtree roots

Source: https://junglewise.ai/threats/cve-2026-52733-zcashfoundation-zebrad-persistent-state-corruption-in-subtree  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-18. Updated: 2026-07-02  
License: CC BY 4.0 with a link back

CVE-2026-52733 · Severity: medium · CVSS 6.5 · Published 2026-08-18

Zebra, a Zcash node implementation, contains a flaw that causes permanent data corruption when the blockchain undergoes a 'fork' (a common event where multiple miners find blocks simultaneously). This corruption affects the records used by mobile and light wallets to synchronize their balances, potentially leading to incorrect wallet states or synchronization failures. Fixing the issue requires node operators to update their software and completely rebuild their local blockchain database.

Technologies: [zebra-state (crates.io)](https://junglewise.ai/threats/technologies/zebra-state), [zebrad (crates.io)](https://junglewise.ai/threats/technologies/zebrad). Vendors: [crates.io](https://junglewise.ai/threats/vendors/crates-io).

## Quick answers

**Is CVE-2026-52733 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-52733 being exploited in the wild.

**How severe is CVE-2026-52733?** Medium severity, with a CVSS score of 6.5, published 18 August 2026.

**Which products and versions are affected?** zebra-state (crates.io) <= 6.0.0, SEMVER:introduced=0,fixed=7.0.0; zebrad (crates.io) <= 4.4.1, SEMVER:introduced=0,fixed=4.5.0.

**Is there a fix for CVE-2026-52733?** Yes. zebra-state (crates.io): upgrade to 7.0.0 or later; zebrad (crates.io): upgrade to 4.5.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-52733 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-52733?** Check whether you run zebra-state (crates.io) or zebrad (crates.io) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- zebra-state (crates.io): upgrade to 7.0.0 or later

  ```sh
  cargo update -p zebra-state
  ```

- zebrad (crates.io): upgrade to 4.5.0 or later

  ```sh
  cargo update -p zebrad
  ```


## Technical details

A logic asymmetry exists between the 'pop_root' and 'pop_tip' methods in the non-finalized state management of Zebra. While 'pop_root' correctly handles finalization cleanup, 'pop_tip' fails to remove note commitment subtree root contributions when a block is reverted during a chain fork. This stale in-memory data is subsequently written to the persistent RocksDB state during the next finalization event. The resulting corruption affects the 'z_getsubtreesbyindex' RPC, causing downstream consumers like lightwalletd to receive incorrect data. The vulnerability is tracked as CWE-459 (Incomplete Cleanup) and requires a full state rebuild to remediate existing corruption.

## Affected products

- ZcashFoundation zebrad <= 4.4.1
- ZcashFoundation zebra-state <= 6.0.0

## Identifiers

- CVE-2026-52733
- GHSA-2gf8-q9rr-jq3h

## Timeline

- 2026-05-29: disclosed: Private submission via GitHub Security Advisory
- 2026-07-02: advisory

## References

- [https://api.github.com/users/dingledropper](https://api.github.com/users/dingledropper)
- [https://github.com/dingledropper](https://github.com/dingledropper)
- [https://api.github.com/users/dingledropper/gists%7B/gist_id%7D](https://api.github.com/users/dingledropper/gists%7B/gist_id%7D)
- [https://api.github.com/users/dingledropper/repos](https://api.github.com/users/dingledropper/repos)
- [https://avatars.githubusercontent.com/u/96898335?v=4](https://avatars.githubusercontent.com/u/96898335?v=4)
- [https://api.github.com/users/dingledropper/events%7B/privacy%7D](https://api.github.com/users/dingledropper/events%7B/privacy%7D)

## Related threats

- [ZcashFoundation Zebra assertion panic in address book mempool update](https://junglewise.ai/threats/cve-2026-52829-zcashfoundation-zebra-assertion-panic-in-address-book-mempool)
- [ZcashFoundation Zebra process abort via repeated shielded transactions](https://junglewise.ai/threats/cve-2026-52739-zcashfoundation-zebra-process-abort-via-repeated-shielded)
- [ZcashFoundation Zebra denial of service via balance overflow in state writer](https://junglewise.ai/threats/cve-2026-52738-zcashfoundation-zebra-denial-of-service-via-balance-overflow-in)
- [Zcash Zebra sync restart poisoning via above-lookahead block](https://junglewise.ai/threats/cve-2026-52737-zcash-zebra-sync-restart-poisoning-via-above-lookahead-block)
- [ZcashFoundation Zebra block suppression via same-header body poisoning](https://junglewise.ai/threats/cve-2026-52736-zcashfoundation-zebra-block-suppression-via-same-header-body)