CVE-2026-52737: Zcash Zebra sync restart poisoning via above-lookahead block

CVE-2026-52737 · Severity: medium · CVSS 5.3 · Published 2026-08-18

A vulnerability in the Zebra Zcash node software allows a single malicious user to repeatedly stall the synchronization process of other nodes. By sending specially crafted but invalid block information, an attacker can force a node to restart its entire sync cycle every 67 seconds. This results in a significant degradation of service, preventing the node from staying up to date with the blockchain network.

Technologies: zebra-consensus (crates.io), zebrad (crates.io). Vendors: crates.io.

Quick answers

Is CVE-2026-52737 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-52737 being exploited in the wild.
How severe is CVE-2026-52737?
Medium severity, with a CVSS score of 5.3, published 18 August 2026.
Which products and versions are affected?
zebra-consensus (crates.io) <= 6.0.0, SEMVER:introduced=0,fixed=7.0.0; zebrad (crates.io) <= 4.4.1, SEMVER:introduced=0,fixed=4.5.0.
Is there a fix for CVE-2026-52737?
Yes. zebra-consensus (crates.io): upgrade to 7.0.0 or later; zebrad (crates.io): upgrade to 4.5.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-52737 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-52737?
Check whether you run zebra-consensus (crates.io) or zebrad (crates.io) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • zebra-consensus (crates.io): upgrade to 7.0.0 or later
    cargo update -p zebra-consensus
  • zebrad (crates.io): upgrade to 4.5.0 or later
    cargo update -p zebrad

Technical details

The vulnerability exists in the interaction between Zebra's syncer and its error handling logic. A malicious peer can provide a syntactically valid block with a coinbase height far above the victim's local tip, triggering an 'AboveLookaheadHeightLimit' error. Because this specific error variant does not carry the advertiser's peer address, the syncer fails to penalize the offending peer and instead defaults to a global sync restart. This restart cancels all in-flight downloads from honest peers and imposes a 67-second delay. The attack requires only an unauthenticated P2P connection and can be repeated indefinitely. The issue is fixed in Zebra 4.4.2 by ensuring peer addresses are tracked through height-related errors and making such failures peer-local rather than global.

Affected products

  • Zcash Foundation zebrad <= 4.4.1
  • Zcash Foundation zebra-consensus <= 6.0.0

Identifiers

  • CVE-2026-52737
  • GHSA-gvjc-3w7c-92jx

Timeline

  • 2026-05-29: disclosed
  • 2026-07-02: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.