Chain Fork Vulnerability in Zcash Node from Zcash Foundation
CVE-2026-52733

6.5MEDIUM

Key Information:

Vendor: Zcashfoundation
Status: Zebra; Zebra-state
Vendor: CVE Published:; 18 August 2026

🔔 Create Zcashfoundation Vulnerability Alert

What is CVE-2026-52733?

Zebra is a Zcash node implemented in Rust that has a vulnerability where stale subtree roots may remain in its state after a chain fork. When a reverted tip block is removed, the corresponding subtree entries are not cleaned up correctly. This can result in stale data being retained, potentially leading to incorrect subtree roots being returned to consumers like lightwalletd and light wallets. This inconsistency can cause wallet synchronization failures and incorrect wallet states, necessitating a complete state rebuild for recovery. The issue was addressed in version 4.5.0.