CVE-2026-52738: ZcashFoundation Zebra denial of service via balance overflow in state writer

CVE-2026-52738 · Severity: medium · CVSS 4 · Published 2026-08-18

Zebra is a software implementation used to run nodes on the Zcash cryptocurrency network. A vulnerability has been identified where a specially crafted, valid block can cause the software to crash and fail to restart. This results in a permanent halt of the node, disrupting services such as wallets, exchanges, and mining operations that rely on it.

Technologies: zebra-state (crates.io), zebrad (crates.io). Vendors: crates.io.

Quick answers

Is CVE-2026-52738 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-52738 being exploited in the wild.
How severe is CVE-2026-52738?
Medium severity, with a CVSS score of 4, published 18 August 2026.
Which products and versions are affected?
zebra-state (crates.io) <= 6.0.0, SEMVER:introduced=0,fixed=7.0.0; zebrad (crates.io) <= 4.4.1, SEMVER:introduced=0,fixed=4.5.0.
Is there a fix for CVE-2026-52738?
Yes. zebra-state (crates.io): upgrade to 7.0.0 or later; zebrad (crates.io): upgrade to 4.5.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-52738 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-52738?
Check whether you run zebra-state (crates.io) or zebrad (crates.io) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • zebra-state (crates.io): upgrade to 7.0.0 or later
    cargo update -p zebra-state
  • zebrad (crates.io): upgrade to 4.5.0 or later
    cargo update -p zebrad

Technical details

The vulnerability is an uncaught exception (panic) caused by an integer overflow in the finalized state writer located at zebra-state/src/service/finalized_state/zebra_db/transparent.rs. The component processes all transaction outputs (credits) in a block before processing inputs (debits); a block containing many self-spends to the same address can cause the intermediate balance to exceed the MAX_MONEY supply cap, triggering a panic via .expect(). Because the block is consensus-valid, the node will re-encounter and re-process the same block upon restart, creating a permanent chain halt. An attacker with sufficient ZEC and mining capability can exploit this remotely by mining a malicious block. The issue is fixed in Zebra 4.4.2 (zebrad) and 7.0.0 (zebra-state) by processing credits and debits together per transaction.

Affected products

  • ZcashFoundation zebrad <= 4.4.1
  • ZcashFoundation zebra-state <= 6.0.0

Identifiers

  • CVE-2026-52738
  • GHSA-w834-cf6p-9m9w

Timeline

  • 2026-05-29: disclosed
  • 2026-07-02: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.