CVE-2026-52733 ZEBRA: Persistent on-disk corruption of Sapling/Orchard subtree roots after chain fork via pop_tip
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-52733?
CVE-2026-52733 is a medium-severity vulnerability in ZcashFoundation zebra, published on 18 Aug 2026.
Official description
ZEBRA is a Zcash node written entirely in Rust. Prior to 4.5.0, a natural or attacker-influenced chain fork can leave stale Sapling and Orchard note-commitment subtree roots in Zebra state. In zebra-state/src/service/non_finalized_state/chain.rs, Chain::pop_tip removed a reverted tip block but did not remove subtree entries whose end_height belonged to that block, unlike the cleanup performed by pop_root. When the winning fork later finalized, the abandoned branch's stale subtree data could be written to RocksDB and survive node restarts. The corrupted history can cause z_getsubtreesbyindex consumers such as lightwalletd and light wallets to receive incorrect subtree roots, producing wallet synchronization failures or incorrect wallet state and requiring a full state rebuild for recovery. This issue is fixed in version 4.5.0.
Which versions are affected by CVE-2026-52733?
4 open source packages ship an affected version, including zebra-state and zebrad.
| Package | Affected | Fixed in |
|---|---|---|
zebra-state crates.io | All versions | 7.0.0 |
zebra-state crates.io | All versions | 7.0.0 |
zebrad crates.io | All versions | 4.5.0 |
zebrad crates.io | All versions | 4.5.0 |
How do I fix CVE-2026-52733?
Upgrade zebra-state to 7.0.0 or later.
Is CVE-2026-52733 being exploited?
There is no known exploitation of CVE-2026-52733 in the wild and no public exploit code.
Sources
Also known as GHSA-2gf8-q9rr-jq3h.