---
id: CVE-2026-52731
title: ZEBRA is a Zcash node written entirely in Rust
summary: >-
  ZEBRA is a Zcash node written entirely in Rust. Prior to 4.5.0, an attacker
  authenticated to an enabled Zebra RPC endpoint can terminate zebrad by
  supplying a getblocktemplate LongPollId containing multi-byte UTF-8
  characters. In zebra-r…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'
cwe:
  - CWE-248
vendor: zebra-rpc
product: zebra-rpc
affected:
  - zebra-rpc <= 7.0.0
  - zebrad <= 4.4.1
patched:
  - zebra-rpc 8.0.0
  - zebrad 4.5.0
published: '2026-08-18'
updated: '2026-09-09'
sourceUpdated: '2026-09-09T21:13:25.910'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-52731'
references:
  - url: >-
      https://github.com/ZcashFoundation/zebra/commit/1440b43ca7df59aca948090d45117557b217a6cd
    label: security-advisories@github.com
  - url: 'https://github.com/ZcashFoundation/zebra/releases/tag/v4.5.0'
    label: security-advisories@github.com
  - url: >-
      https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-qv2r-v3mx-f4pf
    label: security-advisories@github.com
  - url: >-
      https://github.com/ZcashFoundation/zebra/blob/d4cd662c716382f6397d2a730148025a1ca79fec/Cargo.toml#L305
  - url: 'https://github.com/advisories/GHSA-qv2r-v3mx-f4pf'
tags:
  - nvd
  - ghsa
  - rust
epss: 0.0053
epssPercentile: 0.42423
ecosystem: rust
ingestedAt: '2026-07-02T19:41:50.927Z'
---

## Overview

ZEBRA is a Zcash node written entirely in Rust. Prior to 4.5.0, an attacker authenticated to an enabled Zebra RPC endpoint can terminate zebrad by supplying a getblocktemplate LongPollId containing multi-byte UTF-8 characters. In zebra-rpc/src/methods/types/long_poll.rs, LongPollId::from_str originally checked the input byte length and then sliced fixed byte ranges to parse encoded fields. A slice boundary can land inside a multi-byte character and trigger Rust's byte index is not a char boundary panic. Zebra release builds use panic equals abort, so one malformed authenticated RPC request terminates the entire node process and can be repeated after restart. This issue is fixed in version 4.5.0.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-52731)

Affected packages:

- `zebra-rpc <= 7.0.0`
- `zebrad <= 4.4.1`

Patched in:

- `zebra-rpc 8.0.0`
- `zebrad 4.5.0`

Source: https://github.com/advisories/GHSA-qv2r-v3mx-f4pf