Denial of Service Vulnerability in Zcash Node by Zcash Foundation

CVE-2026-52731

What is CVE-2026-52731?

A denial of service vulnerability exists in the Zebra node before version 4.5.0, which is affected by how the LongPollId is processed in authenticated RPC requests. An attacker can exploit this issue by supplying a malformed getblocktemplate LongPollId that contains multi-byte UTF-8 characters. This leads to a panic in the Rust runtime, causing the entire node process to terminate. The vulnerability is particularly dangerous as it can be repeatedly triggered after a restart, making the node vulnerable to persistent attacks. This issue was addressed in the 4.5.0 release, which rectifies the handling of input strings, ensuring stability during RPC calls.

References