CVE-2026-52733: CWE-459: Incomplete Cleanup in ZcashFoundation zebra
ZEBRA is a Zcash node written entirely in Rust. Prior to 4.5.0, a natural or attacker-influenced chain fork can leave stale Sapling and Orchard note-commitment subtree roots in Zebra state. In zebra-state/src/service/non_finalized_state/chain.rs, Chain::pop_tip removed a reverted tip block but did not remove subtree entries whose end_height belonged to that block, unlike the cleanup performed by pop_root. When the winning fork later finalized, the abandoned branch's stale subtree data could be written to RocksDB and survive node restarts. The corrupted history can cause z_getsubtreesbyindex consumers such as lightwalletd and light wallets to receive incorrect subtree roots, producing wallet synchronization failures or incorrect wallet state and requiring a full state rebuild for recovery. This issue is fixed in version 4.5.0.
AI Analysis
Technical Summary
The vulnerability in zebrad (up to v4.4.1) involves improper cleanup of Sapling and Orchard note commitment subtree roots during chain forks. Specifically, when the pop_tip method reverts the tip block on a fork, it retains stale subtree root data in memory, which is then persisted to RocksDB upon chain finalization. This asymmetry with pop_root causes persistent corruption of subtree root history on disk. The corrupted data affects the z_getsubtreesbyindex RPC used by lightwalletd and other light wallets for synchronization, potentially causing incorrect wallet states. The issue does not impact consensus validation of new blocks but requires rebuilding the state database to recover. The fix in zebrad 4.5.0 and zebra-state 7.0.0 adds proper subtree root cleanup to pop_tip.
Potential Impact
The vulnerability causes persistent corruption of Sapling and Orchard subtree root history in the node's RocksDB database, surviving restarts. This leads to incorrect subtree root data being served by z_getsubtreesbyindex, which can cause wallet synchronization failures or incorrect wallet states in downstream consumers such as lightwalletd and light wallets. Consensus validation of new blocks remains unaffected. Recovery from the corruption requires rebuilding the state database from scratch.
Mitigation Recommendations
A patch is available in zebrad version 4.5.0 and zebra-state version 7.0.0 that fixes the improper cleanup of subtree roots during pop_tip. Operators should upgrade to these versions to resolve the issue. There is no configuration-level workaround. Operators can mitigate downstream impact by periodically verifying subtree root consistency using z_getsubtreesbyindex against a known-good reference. Rebuilding the state database is required to recover from existing corruption.
CVE-2026-52733: CWE-459: Incomplete Cleanup in ZcashFoundation zebra
Description
ZEBRA is a Zcash node written entirely in Rust. Prior to 4.5.0, a natural or attacker-influenced chain fork can leave stale Sapling and Orchard note-commitment subtree roots in Zebra state. In zebra-state/src/service/non_finalized_state/chain.rs, Chain::pop_tip removed a reverted tip block but did not remove subtree entries whose end_height belonged to that block, unlike the cleanup performed by pop_root. When the winning fork later finalized, the abandoned branch's stale subtree data could be written to RocksDB and survive node restarts. The corrupted history can cause z_getsubtreesbyindex consumers such as lightwalletd and light wallets to receive incorrect subtree roots, producing wallet synchronization failures or incorrect wallet state and requiring a full state rebuild for recovery. This issue is fixed in version 4.5.0.
CVSS v3.1
Score 6.5medium
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability in zebrad (up to v4.4.1) involves improper cleanup of Sapling and Orchard note commitment subtree roots during chain forks. Specifically, when the pop_tip method reverts the tip block on a fork, it retains stale subtree root data in memory, which is then persisted to RocksDB upon chain finalization. This asymmetry with pop_root causes persistent corruption of subtree root history on disk. The corrupted data affects the z_getsubtreesbyindex RPC used by lightwalletd and other light wallets for synchronization, potentially causing incorrect wallet states. The issue does not impact consensus validation of new blocks but requires rebuilding the state database to recover. The fix in zebrad 4.5.0 and zebra-state 7.0.0 adds proper subtree root cleanup to pop_tip.
Potential Impact
The vulnerability causes persistent corruption of Sapling and Orchard subtree root history in the node's RocksDB database, surviving restarts. This leads to incorrect subtree root data being served by z_getsubtreesbyindex, which can cause wallet synchronization failures or incorrect wallet states in downstream consumers such as lightwalletd and light wallets. Consensus validation of new blocks remains unaffected. Recovery from the corruption requires rebuilding the state database from scratch.
Mitigation Recommendations
A patch is available in zebrad version 4.5.0 and zebra-state version 7.0.0 that fixes the improper cleanup of subtree roots during pop_tip. Operators should upgrade to these versions to resolve the issue. There is no configuration-level workaround. Operators can mitigate downstream impact by periodically verifying subtree root consistency using z_getsubtreesbyindex against a known-good reference. Rebuilding the state database is required to recover from existing corruption.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-2gf8-q9rr-jq3h
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-52733"]
- Ecosystems
- ["crates.io"]
- Database Specific Severity
- MODERATE
- Cvss Version
- 3.1
Threat ID: 6a46ecb527e9c7971943c8cc
Added to database: 07/02/2026, 22:56:53 UTC
Last enriched: 08/19/2026, 11:14:37 UTC
Last updated: 09/14/2026, 22:01:35 UTC
Views: 81
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.