GHSA-w834-cf6p-9m9w: Zebra: Finalized address balance credit-first overflow on consensus-valid blocks
Zebra nodes running zebrad up to and including version 4.4.1 are vulnerable to a panic caused by an integer overflow during transparent address balance calculation when processing consensus-valid blocks containing many self-spends to the same address. This panic causes the node process to abort and creates a persistent halt that recurs on restart, disrupting node operation until patched. The issue is fixed in Zebra version 4.4.2 by changing the balance update logic to process credits and debits together per transaction. No workaround exists other than upgrading.
AI Analysis
Technical Summary
The vulnerability in Zebra's finalized state writer arises because it processes all transaction outputs (credits) before inputs (debits) within a block, causing intermediate per-address balances to temporarily exceed the maximum allowed money supply (MAX_MONEY) when a block contains a long chain of transparent self-spends to the same address. This triggers a panic due to an overflow check, terminating the node process. Since the block is consensus-valid, the node reprocesses it on restart, causing a persistent halt. An attacker with mining capability and approximately 1,100–2,100 ZEC can create such a block, halting all Zebra nodes until they upgrade to version 4.4.2, which fixes the issue by processing credits and debits together per transaction.
Potential Impact
A single consensus-valid block can cause all Zebra nodes running vulnerable versions to panic and halt permanently, disrupting network operation and downstream services such as light wallets, exchanges, and mining infrastructure. The halt persists across node restarts, requiring deployment of the patched version to recover. The attacker incurs only mining costs, as the self-spends return funds to the same address.
Mitigation Recommendations
Upgrade Zebra nodes to version 4.4.2 or later, where the vulnerability is fixed by processing credits and debits together per transaction. No workaround is available. Patch status is confirmed by the vendor advisory.
GHSA-w834-cf6p-9m9w: Zebra: Finalized address balance credit-first overflow on consensus-valid blocks
Description
Zebra nodes running zebrad up to and including version 4.4.1 are vulnerable to a panic caused by an integer overflow during transparent address balance calculation when processing consensus-valid blocks containing many self-spends to the same address. This panic causes the node process to abort and creates a persistent halt that recurs on restart, disrupting node operation until patched. The issue is fixed in Zebra version 4.4.2 by changing the balance update logic to process credits and debits together per transaction. No workaround exists other than upgrading.
CVSS v4.0
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability in Zebra's finalized state writer arises because it processes all transaction outputs (credits) before inputs (debits) within a block, causing intermediate per-address balances to temporarily exceed the maximum allowed money supply (MAX_MONEY) when a block contains a long chain of transparent self-spends to the same address. This triggers a panic due to an overflow check, terminating the node process. Since the block is consensus-valid, the node reprocesses it on restart, causing a persistent halt. An attacker with mining capability and approximately 1,100–2,100 ZEC can create such a block, halting all Zebra nodes until they upgrade to version 4.4.2, which fixes the issue by processing credits and debits together per transaction.
Potential Impact
A single consensus-valid block can cause all Zebra nodes running vulnerable versions to panic and halt permanently, disrupting network operation and downstream services such as light wallets, exchanges, and mining infrastructure. The halt persists across node restarts, requiring deployment of the patched version to recover. The attacker incurs only mining costs, as the self-spends return funds to the same address.
Mitigation Recommendations
Upgrade Zebra nodes to version 4.4.2 or later, where the vulnerability is fixed by processing credits and debits together per transaction. No workaround is available. Patch status is confirmed by the vendor advisory.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-w834-cf6p-9m9w
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-52738"]
- Ecosystems
- ["crates.io"]
- Database Specific Severity
- MODERATE
- Cvss Version
- 4.0
Threat ID: 6a46ecb627e9c7971943c9a9
Added to database: 07/02/2026, 22:56:54 UTC
Last enriched: 07/02/2026, 23:11:04 UTC
Last updated: 07/02/2026, 23:11:04 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.