Skip to content
Heist/ feed
Back to feed
High

ZEBRA: Block suppression via NU5 same-header body poisoning of sent-hash cache

Type: advisorySources: OSV

ZEBRA is a Zcash node written entirely in Rust. Prior to 4.5.0, a remote unauthenticated P2P peer can stall a Zebra node by racing an invalid block body against the valid canonical body for the same block header hash. ZIP-244 permits the attacker to mutate coinbase scriptSig authentication data while retaining the transaction identifiers, merkle root, and block header hash, so the poisoned body fails later commitment validation but shares the canonical hash. In zebra-state/src/service.rs, queue_and_commit_to_non_finalized_state recorded the hash in non_finalized_block_write_sent_hashes before contextual validation completed and did not remove it when the write task rejected the body. When the honest body later arrived, the cached hash caused KnownBlock::WriteChannel duplicate handling to suppress it, leaving the node stuck one height behind until restart or reorganization. This issue is fixed in version 4.5.0.

Products
Not specified
Affected versions
Not specified
Fixed versions
Not specified
CVEs
CVE-2026-52736
Confirmed fixed CVEs
Not specified
Updated in this feed
3 Nov 2026, 04:40 UTC · Revision 1

Source evidence

ZEBRA: Block suppression via NU5 same-header body poisoning of sent-hash cache

core-osv · Original source

Published 18 Aug 2026, 19:26 UTC

ZEBRA is a Zcash node written entirely in Rust. Prior to 4.5.0, a remote unauthenticated P2P peer can stall a Zebra node by racing an invalid block body against the valid canonical body for the same block header hash. ZIP-244 permits the attacker to mutate coinbase scriptSig authentication data while retaining the transaction identifiers, merkle root, and block header hash, so the poisoned body fails later commitment validation but shares the canonical hash. In zebra-state/src/service.rs, queue_and_commit_to_non_finalized_state recorded the hash in non_finalized_block_write_sent_hashes before contextual validation completed and did not remove it when the write task rejected the body. When the honest body later arrived, the cached hash caused KnownBlock::WriteChannel duplicate handling to suppress it, leaving the node stuck one height behind until restart or reorganization. This issue is fixed in version 4.5.0.

osv:CVE-2026-52736
Complete source record
{
  "id": "b75c3b60e0fba1c677e138e074cf31591203d5178ab9c8d30b619dd70fb8557b",
  "url": "https://osv.dev/vulnerability/CVE-2026-52736",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "ZEBRA: Block suppression via NU5 same-header body poisoning of sent-hash cache",
    "summary": "ZEBRA is a Zcash node written entirely in Rust. Prior to 4.5.0, a remote unauthenticated P2P peer can stall a Zebra node by racing an invalid block body against the valid canonical body for the same block header hash. ZIP-244 permits the attacker to mutate coinbase scriptSig authentication data while retaining the transaction identifiers, merkle root, and block header hash, so the poisoned body fails later commitment validation but shares the canonical hash. In zebra-state/src/service.rs, queue_and_commit_to_non_finalized_state recorded the hash in non_finalized_block_write_sent_hashes before contextual validation completed and did not remove it when the write task rejected the body. When the honest body later arrived, the cached hash caused KnownBlock::WriteChannel duplicate handling to suppress it, leaving the node stuck one height behind until restart or reorganization. This issue is fixed in version 4.5.0.",
    "evidence": "osv:CVE-2026-52736",
    "products": [],
    "severity": "high",
    "structured": {
      "id": "CVE-2026-52736",
      "aliases": [
        "CVE-2026-52736",
        "GHSA-4m69-67m6-prqp"
      ],
      "metrics": [
        {
          "type": "CVSS_V4",
          "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://github.com/zcashfoundation/zebra",
              "type": "GIT",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "1440b43ca7df59aca948090d45117557b217a6cd"
                }
              ],
              "database_specific": {
                "extracted_events": [
                  {
                    "range": [
                      {
                        "introduced": "0"
                      },
                      {
                        "fixed": "4.5.0"
                      }
                    ],
                    "source": "AFFECTED_FIELD",
                    "strategy": "StringRangeExpression"
                  },
                  {
                    "range": [
                      {
                        "fixed": "1440b43ca7df59aca948090d45117557b217a6cd"
                      }
                    ],
                    "source": "REFERENCES_COMMIT"
                  },
                  {
                    "range": [
                      {
                        "fixed": "1440b43ca7df59aca948090d45117557b217a6cd"
                      }
                    ],
                    "source": "REFERENCES_TAG",
                    "original_tag": "v4.5.0"
                  },
                  {
                    "range": [
                      {
                        "introduced": "0"
                      },
                      {
                        "fixed": "4.5.0"
                      }
                    ],
                    "source": "DESCRIPTION"
                  }
                ]
              }
            }
          ],
          "versions": [
            "v4.4.0",
            "v4.4.1",
            "v4.3.1",
            "4.3.1",
            "v4.3.0",
            "v4.2.0",
            "v4.1.0",
            "v4.0.0",
            "v3.1.0",
            "v3.0.0",
            "v3.0.0-rc.0",
            "v2.5.0",
            "v2.0.1",
            "v2.4.2",
            "v2.3.0",
            "v2.4.0",
            "v2.0.0",
            "v2.2.0",
            "v2.1.0",
            "v2.0.0-rc.0",
            "v1.9.0",
            "v1.8.0",
            "v1.7.0",
            "v1.6.1",
            "v1.6.0",
            "v1.5.2",
            "v1.5.1",
            "v1.5.0",
            "v1.4.0",
            "v1.3.0",
            "v1.2.0",
            "v1.1.0",
            "v1.0.1",
            "v1.0.0",
            "v1.0.0-rc.9",
            "v1.0.0-rc.8",
            "v1.0.0-rc.7",
            "v1.0.0-rc.6",
            "v1.0.0-rc.5",
            "v1.0.0-rc.0",
            "v1.0.0-rc.4",
            "v1.0.0-rc.3",
            "v1.0.0-rc.2",
            "v1.0.0-rc.1",
            "v1.0.0-beta.15",
            "v1.0.0-beta.14",
            "v1.0.0-beta.13",
            "v1.0.0-beta.12",
            "v1.0.0-beta.11",
            "v1.0.0-beta.10",
            "v1.0.0-beta.9",
            "v1.0.0-beta.8",
            "v1.0.0-beta.7",
            "v1.0.0-beta.6",
            "v1.0.0-beta.5",
            "v1.0.0-beta.4",
            "v1.0.0-beta.3",
            "v1.0.0-beta.2",
            "v1.0.0-beta.1",
            "v1.0.0-beta.0",
            "v1.0.0-alpha.19",
            "v1.0.0-alpha.18",
            "v1.0.0-alpha.17",
            "v1.0.0-alpha.16",
            "v1.0.0-alpha.15",
            "v1.0.0-alpha.14",
            "v1.0.0-alpha.13",
            "v1.0.0-alpha.12",
            "v1.0.0-alpha.11",
            "v1.0.0-alpha.10",
            "v1.0.0-alpha.9",
            "v1.0.0-alpha.8",
            "v1.0.0-alpha.7",
            "v1.0.0-alpha.6",
            "v1.0.0-alpha.5",
            "v1.0.0-alpha.4",
            "v1.0.0-alpha.3",
            "v1.0.0-alpha.2",
            "v1.0.0-alpha.1",
            "v1.0.0-alpha.0"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-52736.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:25.676702032Z",
      "provider": "osv",
      "references": [
        "https://github.com/ZcashFoundation/zebra/releases/tag/v4.5.0",
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/52xxx/CVE-2026-52736.json",
        "https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-4m69-67m6-prqp",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-52736",
        "https://github.com/ZcashFoundation/zebra/commit/1440b43ca7df59aca948090d45117557b217a6cd"
      ],
      "provider_metadata": {
        "cwe_ids": [
          "CWE-459"
        ],
        "cna_assigner": "GitHub_M",
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/52xxx/CVE-2026-52736.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2026-52736",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 492509,
  "published_at": "2026-08-18T19:26:40.575+00:00"
}