ZcashFoundation Zebra up to 4.4.x zebra-state chain.rs Chain::pop_tip state issue

Summaryinfo

A vulnerability has been found in ZcashFoundation Zebra up to 4.4.x and classified as critical. This vulnerability affects the function Chain::pop_tip of the file zebra-state/src/service/non_finalized_state/chain.rs of the component zebra-state. This manipulation causes state issue. This vulnerability appears as CVE-2026-52733. The attack may be initiated remotely. There is no available exploit.

Detailsinfo

A vulnerability classified as critical was found in ZcashFoundation Zebra up to 4.4.x. Affected by this vulnerability is the function Chain::pop_tip of the file zebra-state/src/service/non_finalized_state/chain.rs of the component zebra-state. The manipulation with an unknown input leads to a state issue vulnerability. The CWE definition for the vulnerability is CWE-371. As an impact it is known to affect integrity, and availability. The summary by CVE is:

ZEBRA is a Zcash node written entirely in Rust. Prior to 4.5.0, a natural or attacker-influenced chain fork can leave stale Sapling and Orchard note-commitment subtree roots in Zebra state. In zebra-state/src/service/non_finalized_state/chain.rs, Chain::pop_tip removed a reverted tip block but did not remove subtree entries whose end_height belonged to that block, unlike the cleanup performed by pop_root. When the winning fork later finalized, the abandoned branch's stale subtree data could be written to RocksDB and survive node restarts. The corrupted history can cause z_getsubtreesbyindex consumers such as lightwalletd and light wallets to receive incorrect subtree roots, producing wallet synchronization failures or incorrect wallet state and requiring a full state rebuild for recovery. This issue is fixed in version 4.5.0.

The advisory is shared at github.com. This vulnerability is known as CVE-2026-52733 since 06/08/2026. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. Technical details are known, but no exploit is available.

Upgrading to version 4.5.0 eliminates this vulnerability.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Vendor

• ZcashFoundation

Name

• Zebra

Version

• 4.0
• 4.1
• 4.2
• 4.3
• 4.4

Website

• Product: https://github.com/ZcashFoundation/zebra/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion