CVE-2026-52733
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk27th percentile - higher than 27% of all known CVEs
Summary
ZEBRA is a Zcash node written in Rust. Prior to 4.5.0, a chain fork can leave stale Sapling and Orchard note-commitment subtree roots in Zebra state. This can lead to incorrect subtree roots served to consumers like lightwalletd, causing wallet sync failures.
Risk Assessment
The risk includes incorrect wallet synchronization and state, potentially requiring a full state rebuild for recovery.
Recommendation
Upgrade ZEBRA to version 4.5.0 or later, which fixes the issue by cleaning up stale subtree entries on pop_tip.
Original NVD description (English source)
ZEBRA is a Zcash node written entirely in Rust. Prior to 4.5.0, a natural or attacker-influenced chain fork can leave stale Sapling and Orchard note-commitment subtree roots in Zebra state. In zebra-state/src/service/non_finalized_state/chain.rs, Chain::pop_tip removed a reverted tip block but did not remove subtree entries whose end_height belonged to that block, unlike the cleanup performed by pop_root. When the winning fork later finalized, the abandoned branch's stale subtree data could be written to RocksDB and survive node restarts. The corrupted history can cause z_getsubtreesbyindex consumers such as lightwalletd and light wallets to receive incorrect subtree roots, producing wallet synchronization failures or incorrect wallet state and requiring a full state rebuild for recovery. This issue is fixed in version 4.5.0.