ZEBRA Zcash Node Vulnerability Exploits Transaction Handling Flaw

CVE-2026-52739

What is CVE-2026-52739?

A flaw in the ZEBRA Zcash node prior to version 4.5.0 allows a malicious block producer to cause the node to terminate. This occurs when the same shielded transaction is included in both a non-finalized parent block and its child, circumventing the uniqueness assertion of transaction hashes. Due to a unique assertion mechanism in the codebase, this can lead to a significant denial of service by forcing the node to halt unexpectedly. This vulnerability requires a specific sequence of blocks to exploit effectively, including two consecutively mined blocks by the attacker. The issue has been addressed in version 4.5.0, which ensures better handling of such transactions.

References