CVE-2026-52736 ZcashFoundation CVE debrief

Who should care

Defenders responsible for Zebra node deployment and maintenance should assess exposure and prioritize updating to version 4.5.0 or later. They should also verify node version and monitor node performance to prevent node stalling. Additionally, defenders should review compensating controls for exposed systems and track exceptions and retest remediated assets.

Why it matters

CVE-2026-52736 is a vulnerability in the Zebra node that allows a remote unauthenticated P2P peer to stall the node. Defenders responsible for Zebra node deployment and maintenance should assess exposure and prioritize updating to version 4.5.0 or later.

• Node stalling can lead to performance degradation and potential loss of service.
• Verification of node version is necessary to determine exposure.
• Updating to version 4.5.0 or later can prevent node stalling.
• Further analysis is required to determine potential downstream impacts.

Technical summary

A remote unauthenticated P2P peer can stall a Zebra node by racing an invalid block body against the valid canonical body for the same block header hash. ZIP-244 permits the attacker to mutate coinbase scriptSig authentication data while retaining the transaction identifiers, merkle root, and block header hash, so the poisoned body fails later commitment validation but shares the canonical hash. In zebra-state/src/service.rs, queue_and_commit_to_non_finalized_state recorded the hash in non_finalized_block_write_sent_hashes before contextual validation completed and did not remove it when the write task rejected the body.

Defensive priority

Defenders should prioritize verifying node version and updating to 4.5.0 or later to prevent node stalling.

Recommended defensive actions

• Verify node version and update to 4.5.0 or later
• Monitor node performance and restart or reorganize as needed
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed

Evidence notes

The CVE record and NVD entry provide details on the vulnerability and its fix in version 4.5.0. The vulnerability is caused by a flaw in the Zebra node's handling of block bodies, which allows an attacker to stall the node. The fix is included in version 4.5.0. Defenders should verify node version and update to 4.5.0 or later to prevent node stalling. The CVE record and NVD entry provide additional information on the vulnerability and its impact.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.