CVE-2026-52738 ZcashFoundation CVE debrief

Who should care

Defenders responsible for Zebra node deployment and maintenance should assess exposure and prioritize updating to version 4.5.0 or later to prevent node halting. This includes operators, security teams, and vulnerability management teams that oversee Zebra node deployments. Defenders should review and test node configurations, monitor node performance, and verify that their deployments are updated to version 4.5.0 or later.

Why it matters

CVE-2026-52738 is a medium-severity vulnerability in Zebra nodes that can cause node halting prior to version 4.5.0. Defenders should prioritize updating to version 4.5.0 or later to prevent node halting.

• Node halting requires manual intervention to restart
• Potential for denial of service
• Need for version 4.5.0 or later patching

Technical summary

A consensus-valid block containing a long chain of transparent self-spends to one address can permanently halt Zebra nodes prior to version 4.5.0. The issue is caused by a credit-first ordering in the finalized-state writer, which can make the intermediate per-address balance exceed MAX_MONEY. This can occur when a block contains a long chain of transparent self-spends to one address. The issue is fixed in version 4.5.0. Defenders should prioritize updating to version 4.5.0 or later to prevent node halting. The vulnerability has a medium severity and can cause node halting, requiring manual intervention to restart.

Defensive priority

Defenders should prioritize updating to version 4.5.0 or later to prevent node halting.

Recommended defensive actions

• Update to version 4.5.0 or later
• Review and test node configurations
• Monitor node performance
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The issue is caused by a credit-first ordering in the finalized-state writer, which can make the intermediate per-address balance exceed MAX_MONEY. This credit-first ordering can occur when a consensus-valid block contains a long chain of transparent self-spends to one address. The issue is fixed in version 4.5.0. Defenders should verify that their Zebra node deployments are updated to version 4.5.0 or later to prevent node halting.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.