ZcashFoundation Zebra up to 4.4.x RPC Long Poll long_poll.rs LongPollId::from_str out-of-bounds

Summaryinfo

A vulnerability marked as problematic has been reported in ZcashFoundation Zebra up to 4.4.x. Affected by this vulnerability is the function LongPollId::from_str of the file zebra-rpc/src/methods/types/long_poll.rs of the component RPC Long Poll. Performing a manipulation results in out-of-bounds. This vulnerability is identified as CVE-2026-52731. The attack can be initiated remotely. There is not any exploit available.

Detailsinfo

A vulnerability classified as problematic has been found in ZcashFoundation Zebra up to 4.4.x. This affects the function LongPollId::from_str of the file zebra-rpc/src/methods/types/long_poll.rs of the component RPC Long Poll. The manipulation with an unknown input leads to a out-of-bounds vulnerability. CWE is classifying the issue as CWE-125. The product reads data past the end, or before the beginning, of the intended buffer. This is going to have an impact on availability. The summary by CVE is:

ZEBRA is a Zcash node written entirely in Rust. Prior to 4.5.0, an attacker authenticated to an enabled Zebra RPC endpoint can terminate zebrad by supplying a getblocktemplate LongPollId containing multi-byte UTF-8 characters. In zebra-rpc/src/methods/types/long_poll.rs, LongPollId::from_str originally checked the input byte length and then sliced fixed byte ranges to parse encoded fields. A slice boundary can land inside a multi-byte character and trigger Rust's byte index is not a char boundary panic. Zebra release builds use panic equals abort, so one malformed authenticated RPC request terminates the entire node process and can be repeated after restart. This issue is fixed in version 4.5.0.

The advisory is shared at github.com. This vulnerability is uniquely identified as CVE-2026-52731 since 06/08/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. Technical details are known, but no exploit is available.

Upgrading to version 4.5.0 eliminates this vulnerability.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Vendor

• ZcashFoundation

Name

• Zebra

Version

• 4.0
• 4.1
• 4.2
• 4.3
• 4.4

Website

• Product: https://github.com/ZcashFoundation/zebra/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion