CVE-2026-52738

{
  "id": "CVE-2026-52738",
  "sourceIdentifier": "[email protected]",
  "published": "2026-08-18T20:17:17.953",
  "lastModified": "2026-11-09T20:10:00.200",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "ZEBRA is a Zcash node written entirely in Rust. Prior to 4.5.0, a consensus-valid block containing a long chain of transparent self-spends to one address can permanently halt Zebra nodes. In zebra-state/src/service/finalized_state/zebra_db/transparent.rs, the finalized-state writer originally applied every newly created output as a credit before applying any spent-output debit from the same block. That credit-first ordering can make the intermediate per-address balance exceed MAX_MONEY even though the final net balance is valid, causing an expect-based panic under the panic equals abort release profile. Because zcashd accepts the triggering block and Zebra encounters it again after every restart, the halt persists until patched software is deployed; exploitation requires mining the specially constructed block and temporarily committing sufficient ZEC to the self-spend chain. This issue is fixed in version 4.5.0."
    },
    {
      "lang": "es",
      "value": "ZEBRA es un nodo Zcash escrito completamente en Rust. Antes de 4.5.0, un bloque válido por consenso que contiene una larga cadena de auto-gastos transparentes a una única dirección puede detener permanentemente los nodos Zebra. En zebra-state/src/service/finalized_state/zebra_db/transparent.rs, el escritor de estado finalizado originalmente aplicaba cada salida recién creada como un crédito antes de aplicar cualquier débito de salida gastada del mismo bloque. Ese orden de ’crédito primero’ puede hacer que el saldo intermedio por dirección exceda MAX_MONEY aunque el saldo neto final sea válido, causando un pánico basado en ’expect’ bajo el perfil de lanzamiento ’panic equals abort’. Debido a que zcashd acepta el bloque desencadenante y Zebra lo encuentra de nuevo después de cada reinicio, la detención persiste hasta que se implementa software parcheado; la explotación requiere minar el bloque especialmente construido y comprometer temporalmente suficiente ZEC a la cadena de auto-gastos. Este problema está solucionado en la versión 4.5.0."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "ZcashFoundation",
          "product": "zebra",
          "versions": [
            {
              "version": "< 4.5.0",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "ZcashFoundation",
          "product": "zebra-state",
          "versions": [
            {
              "version": "< 7.0.0",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV40": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "4.0",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "baseScore": 6.9,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "vulnConfidentialityImpact": "NONE",
          "vulnIntegrityImpact": "NONE",
          "vulnAvailabilityImpact": "LOW",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "subAvailabilityImpact": "NONE",
          "exploitMaturity": "NOT_DEFINED",
          "confidentialityRequirement": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "valueDensity": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED"
        }
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-08-19T15:18:53.096673Z",
          "id": "CVE-2026-52738",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-248"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/ZcashFoundation/zebra/commit/1440b43ca7df59aca948090d45117557b217a6cd",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/ZcashFoundation/zebra/releases/tag/v4.5.0",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-w834-cf6p-9m9w",
      "source": "[email protected]"
    }
  ]
}