CVE-2026-52739

{
  "id": "CVE-2026-52739",
  "sourceIdentifier": "[email protected]",
  "published": "2026-08-18T20:17:18.127",
  "lastModified": "2026-11-09T20:10:00.200",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "ZEBRA is a Zcash node written entirely in Rust. Prior to 4.5.0, a malicious block producer can terminate zebrad by placing the same shielded transaction in a non-finalized parent block and its child. In zebra-state/src/service/non_finalized_state/chain.rs, Chain::push originally inserted the transaction hash into tx_loc_by_hash and asserted uniqueness before updating shielded data and running the duplicate Sprout, Sapling, or Orchard nullifier checks. The repeated transaction therefore reached the transactions must be unique within a single chain assertion before contextual validation could reject it cleanly. Zebra release builds use panic equals abort, so the reachable assertion terminates the entire process; exploitation requires either two consecutive attacker-mined blocks or an attacker-mined child immediately after an honest block includes the attacker's shielded transaction. This issue is fixed in version 4.5.0."
    },
    {
      "lang": "es",
      "value": "ZEBRA es un nodo Zcash escrito completamente en Rust. Antes de la versión 4.5.0, un productor de bloques malicioso puede terminar zebrad al colocar la misma transacción blindada en un bloque padre no finalizado y su hijo. En zebra-state/src/service/non_finalized_state/chain.rs, Chain::push originalmente insertaba el hash de la transacción en tx_loc_by_hash y afirmaba la unicidad antes de actualizar los datos blindados y ejecutar las comprobaciones de nulificador duplicado de Sprout, Sapling u Orchard. La transacción repetida, por lo tanto, alcanzaba la aserción ’las transacciones deben ser únicas dentro de una sola cadena’ antes de que la validación contextual pudiera rechazarla limpiamente. Las compilaciones de lanzamiento de Zebra usan panic igual a abortar, por lo que la aserción alcanzable termina todo el proceso; la explotación requiere o dos bloques consecutivos minados por el atacante o un hijo minado por el atacante inmediatamente después de que un bloque honesto incluya la transacción blindada del atacante. Este problema está solucionado en la versión 4.5.0."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "ZcashFoundation",
          "product": "zebra",
          "versions": [
            {
              "version": "< 4.5.0",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "ZcashFoundation",
          "product": "zebra-state",
          "versions": [
            {
              "version": "< 7.0.0",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "baseScore": 5.9,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "HIGH",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 2.2,
        "impactScore": 3.6
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-08-19T18:03:57.639095Z",
          "id": "CVE-2026-52739",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-248"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/ZcashFoundation/zebra/commit/1440b43ca7df59aca948090d45117557b217a6cd",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/ZcashFoundation/zebra/releases/tag/v4.5.0",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-hhm7-qrv5-h4r6",
      "source": "[email protected]"
    }
  ]
}