Consensus Issue in Zebra Node Affecting Zcash Transactions

CVE-2026-52738

What is CVE-2026-52738?

The Zebra node, written in Rust for Zcash, faces a significant issue where a block containing a long chain of self-spends can indefinitely halt the node's operations. This occurs due to an incorrect application order of outputs within the finalized-state writer. Specifically, by applying credits before debits, the balance per address can temporarily exceed the maximum limit, leading to an expect-based panic. Once triggered, this issue persists after restarts, as the block is accepted by zcashd, resulting in continuous halting until a patch is implemented. Users should update to version 4.5.0 or later to resolve this vulnerability.

References