Zebra rpc: zebrad has full node denial of service via non-ASCII LongPollId in getblocktemplate (CVE-2026-52731)
### Am I affected You are affected if: 1. You run `zebrad` up to and including `v4.4.1`. 2. Your `zebrad.toml` sets `rpc.listen_addr` to a TCP address (RPC server is enabled). 3. An attacker can authenticate to the RPC endpoint. With the default `enable_cookie_auth = true`, this requires the attacker to read the `.cookie` file. With `enable_cookie_auth = false`, any network client reaching the RPC port can trigger it. ### Summary The `getblocktemplate` RPC handler panics when parsing a `LongPollId` parameter that contains non-ASCII (multi-byte UTF-8) characters. The handler performs byte-index string slicing on the user-supplied string, which panics in Rust when a byte index falls within a multi-byte character boundary. Because Zebra's release profile sets `panic = "abort"`, the panic terminates the entire node process. ### Details The `getblocktemplate` handler receives a user-supplied `LongPollId` string and slices it at fixed byte offsets to extract the encoded tip hash and tip height. When the string contains multi-byte UTF-8 characters, a byte-index slice can land in the middle of a character, causing Rust's `str` indexing to panic with "byte index is not a char boundary." Under the `panic = "abort"` release profile, this panic terminates the entire `zebrad` process rather than just the RPC task. ### Patches zebra-rpc 8.0.0 and zebrad 4.5.0. Replace byte-index string slicing with character-aware parsing or validate that the `LongPollId` string contains only ASCII characters before slicing. ### Workarounds - Disable the RPC server by removing `rpc.listen_addr` from `zebrad.toml`. - Ensure `enable_cookie_auth = true` (the default) and restrict filesystem access to the `.cookie` file. - Place a reverse proxy in front of the RPC port that validates `LongPollId` parameters are ASCII-only before forwarding. ### Impact A single authenticated RPC request terminates the `zebrad` process. Same impact profile as GHSA-c8w6-x74f-vmg3: repeatable on restart, affects mining pools and infrastructure that forward `getblocktemplate` calls. ### Credit Reported by `@sangsoo-osec` via a private GitHub Security Advisory submission.
AI Analysis
Technical Summary
The getblocktemplate RPC handler in zebrad versions up to v4.4.1 panics when parsing a LongPollId parameter containing non-ASCII UTF-8 characters due to byte-index string slicing that can land inside a multi-byte character boundary. Because zebrad is compiled with panic = "abort", this panic terminates the entire node process, resulting in a full node denial of service. The vulnerability requires the RPC server to be enabled on a TCP address and attacker authentication to the RPC endpoint. The issue is resolved by replacing byte-index slicing with character-aware parsing or validating the LongPollId as ASCII-only. Fixed in zebrad 4.5.0 and zebra-rpc 8.0.0.
Potential Impact
An authenticated attacker can send a specially crafted getblocktemplate RPC request with a non-ASCII LongPollId string, causing the zebrad node process to panic and terminate. This results in a full node denial of service. The impact affects mining pools and infrastructure that forward getblocktemplate calls. The denial of service is repeatable on node restart until patched or mitigated.
Mitigation Recommendations
A fix is available in zebrad 4.5.0 and zebra-rpc 8.0.0. Until upgrading, mitigate by disabling the RPC server (remove rpc.listen_addr from zebrad.toml), ensuring enable_cookie_auth is true and restricting access to the .cookie file, or placing a reverse proxy in front of the RPC port to validate that LongPollId parameters contain only ASCII characters before forwarding.
Zebra rpc: zebrad has full node denial of service via non-ASCII LongPollId in getblocktemplate (CVE-2026-52731)
Description
### Am I affected You are affected if: 1. You run `zebrad` up to and including `v4.4.1`. 2. Your `zebrad.toml` sets `rpc.listen_addr` to a TCP address (RPC server is enabled). 3. An attacker can authenticate to the RPC endpoint. With the default `enable_cookie_auth = true`, this requires the attacker to read the `.cookie` file. With `enable_cookie_auth = false`, any network client reaching the RPC port can trigger it. ### Summary The `getblocktemplate` RPC handler panics when parsing a `LongPollId` parameter that contains non-ASCII (multi-byte UTF-8) characters. The handler performs byte-index string slicing on the user-supplied string, which panics in Rust when a byte index falls within a multi-byte character boundary. Because Zebra's release profile sets `panic = "abort"`, the panic terminates the entire node process. ### Details The `getblocktemplate` handler receives a user-supplied `LongPollId` string and slices it at fixed byte offsets to extract the encoded tip hash and tip height. When the string contains multi-byte UTF-8 characters, a byte-index slice can land in the middle of a character, causing Rust's `str` indexing to panic with "byte index is not a char boundary." Under the `panic = "abort"` release profile, this panic terminates the entire `zebrad` process rather than just the RPC task. ### Patches zebra-rpc 8.0.0 and zebrad 4.5.0. Replace byte-index string slicing with character-aware parsing or validate that the `LongPollId` string contains only ASCII characters before slicing. ### Workarounds - Disable the RPC server by removing `rpc.listen_addr` from `zebrad.toml`. - Ensure `enable_cookie_auth = true` (the default) and restrict filesystem access to the `.cookie` file. - Place a reverse proxy in front of the RPC port that validates `LongPollId` parameters are ASCII-only before forwarding. ### Impact A single authenticated RPC request terminates the `zebrad` process. Same impact profile as GHSA-c8w6-x74f-vmg3: repeatable on restart, affects mining pools and infrastructure that forward `getblocktemplate` calls. ### Credit Reported by `@sangsoo-osec` via a private GitHub Security Advisory submission.
CVSS v3.1
Score 6.5medium
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The getblocktemplate RPC handler in zebrad versions up to v4.4.1 panics when parsing a LongPollId parameter containing non-ASCII UTF-8 characters due to byte-index string slicing that can land inside a multi-byte character boundary. Because zebrad is compiled with panic = "abort", this panic terminates the entire node process, resulting in a full node denial of service. The vulnerability requires the RPC server to be enabled on a TCP address and attacker authentication to the RPC endpoint. The issue is resolved by replacing byte-index slicing with character-aware parsing or validating the LongPollId as ASCII-only. Fixed in zebrad 4.5.0 and zebra-rpc 8.0.0.
Potential Impact
An authenticated attacker can send a specially crafted getblocktemplate RPC request with a non-ASCII LongPollId string, causing the zebrad node process to panic and terminate. This results in a full node denial of service. The impact affects mining pools and infrastructure that forward getblocktemplate calls. The denial of service is repeatable on node restart until patched or mitigated.
Mitigation Recommendations
A fix is available in zebrad 4.5.0 and zebra-rpc 8.0.0. Until upgrading, mitigate by disabling the RPC server (remove rpc.listen_addr from zebrad.toml), ensuring enable_cookie_auth is true and restricting access to the .cookie file, or placing a reverse proxy in front of the RPC port to validate that LongPollId parameters contain only ASCII characters before forwarding.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-qv2r-v3mx-f4pf
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-52731"]
- Ecosystems
- ["crates.io"]
- Database Specific Severity
- MODERATE
- Cvss Version
- 3.1
Threat ID: 6a46ecb927e9c7971943cb2c
Added to database: 07/02/2026, 22:56:57 UTC
Last enriched: 07/02/2026, 23:12:51 UTC
Last updated: 07/31/2026, 12:27:30 UTC
Views: 38
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.