Remote Unauthenticated Peer Vulnerability in ZEBRA by Zcash Foundation

CVE-2026-52736

What is CVE-2026-52736?

A remote unauthenticated peer can exploit a vulnerability in ZEBRA, the Zcash node, by racing an invalid block body against a valid one for the same block header hash. This issue arises due to the handling of block hashes in the queue_and_commit_to_non_finalized_state function, which may allow the invalid block body to retain a canonical hash and prevent the node from recognizing a valid update. As a result, the node can become stuck one height behind until a restart or reorganization occurs. This issue has been addressed in version 4.5.0.

References