Zebra state: Zebra: Repeated Non-Finalized Shielded Transaction Aborts Zebra Before Duplicate-Nullifier Rejection (CVE-2026-52739)
ZEBRA is a Zcash node written entirely in Rust. Prior to 4.5.0, a malicious block producer can terminate zebrad by placing the same shielded transaction in a non-finalized parent block and its child. In zebra-state/src/service/non_finalized_state/chain.rs, Chain::push originally inserted the transaction hash into tx_loc_by_hash and asserted uniqueness before updating shielded data and running the duplicate Sprout, Sapling, or Orchard nullifier checks. The repeated transaction therefore reached the transactions must be unique within a single chain assertion before contextual validation could reject it cleanly. Zebra release builds use panic equals abort, so the reachable assertion terminates the entire process; exploitation requires either two consecutive attacker-mined blocks or an attacker-mined child immediately after an honest block includes the attacker's shielded transaction. This issue is fixed in version 4.5.0.
AI Analysis
Technical Summary
The vulnerability (CVE-2026-52739) in zebrad up to v4.4.1 arises from the order of operations in the non-finalized state block push sequence. The transaction-location index is updated with an assert that enforces uniqueness before the shielded nullifier uniqueness check runs. If a child block repeats a shielded transaction from its non-finalized parent, the assert triggers and aborts the node process instead of cleanly rejecting the block. This is due to the duplicate-nullifier check being gated to finalized state and mempool transactions only. Two attack models exist: one requiring control of two consecutive blocks repeating the transaction, and another requiring only the child block to repeat a transaction included by an honest miner in the parent block. The crash is a process abort requiring node restart and can be repeatedly triggered to cause extended downtime. The issue is fixed by replacing the assert with an entry-based check returning a validation error instead of panicking.
Potential Impact
A malicious block producer can cause targeted Zebra nodes to crash by submitting blocks that repeat shielded transactions in the non-finalized state. This results in a process abort that is not recoverable without restarting the node, causing denial of service and liveness issues. The attack does not cause consensus divergence, as zcashd nodes reject the invalid blocks cleanly. The frequency of attack opportunities depends on the attacker's mining hashrate, with higher hashrates increasing the number of potential attacks per day.
Mitigation Recommendations
A patch is available and should be applied: upgrade to zebra-state 7.0.0 and zebrad 4.5.0 or later. The patch replaces the assert with a proper validation error to prevent process aborts. There is no configuration-level workaround; all default configurations are affected. Nodes must be restarted if they abort due to this issue until patched.
Zebra state: Zebra: Repeated Non-Finalized Shielded Transaction Aborts Zebra Before Duplicate-Nullifier Rejection (CVE-2026-52739)
Description
ZEBRA is a Zcash node written entirely in Rust. Prior to 4.5.0, a malicious block producer can terminate zebrad by placing the same shielded transaction in a non-finalized parent block and its child. In zebra-state/src/service/non_finalized_state/chain.rs, Chain::push originally inserted the transaction hash into tx_loc_by_hash and asserted uniqueness before updating shielded data and running the duplicate Sprout, Sapling, or Orchard nullifier checks. The repeated transaction therefore reached the transactions must be unique within a single chain assertion before contextual validation could reject it cleanly. Zebra release builds use panic equals abort, so the reachable assertion terminates the entire process; exploitation requires either two consecutive attacker-mined blocks or an attacker-mined child immediately after an honest block includes the attacker's shielded transaction. This issue is fixed in version 4.5.0.
CVSS v3.1
Score 5.9medium
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability (CVE-2026-52739) in zebrad up to v4.4.1 arises from the order of operations in the non-finalized state block push sequence. The transaction-location index is updated with an assert that enforces uniqueness before the shielded nullifier uniqueness check runs. If a child block repeats a shielded transaction from its non-finalized parent, the assert triggers and aborts the node process instead of cleanly rejecting the block. This is due to the duplicate-nullifier check being gated to finalized state and mempool transactions only. Two attack models exist: one requiring control of two consecutive blocks repeating the transaction, and another requiring only the child block to repeat a transaction included by an honest miner in the parent block. The crash is a process abort requiring node restart and can be repeatedly triggered to cause extended downtime. The issue is fixed by replacing the assert with an entry-based check returning a validation error instead of panicking.
Potential Impact
A malicious block producer can cause targeted Zebra nodes to crash by submitting blocks that repeat shielded transactions in the non-finalized state. This results in a process abort that is not recoverable without restarting the node, causing denial of service and liveness issues. The attack does not cause consensus divergence, as zcashd nodes reject the invalid blocks cleanly. The frequency of attack opportunities depends on the attacker's mining hashrate, with higher hashrates increasing the number of potential attacks per day.
Mitigation Recommendations
A patch is available and should be applied: upgrade to zebra-state 7.0.0 and zebrad 4.5.0 or later. The patch replaces the assert with a proper validation error to prevent process aborts. There is no configuration-level workaround; all default configurations are affected. Nodes must be restarted if they abort due to this issue until patched.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-hhm7-qrv5-h4r6
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-52739"]
- Ecosystems
- ["crates.io"]
- Database Specific Severity
- MODERATE
- Cvss Version
- 3.1
Threat ID: 6a46ecb627e9c7971943c9a2
Added to database: 07/02/2026, 22:56:54 UTC
Last enriched: 08/19/2026, 11:15:10 UTC
Last updated: 09/14/2026, 22:21:38 UTC
Views: 105
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.