What is the CVSS score of CVE-2026-52731?

CVE-2026-52731 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.4%.

Is there a patch available for CVE-2026-52731?

Yes, a patch is available for CVE-2026-52731. Update the affected software to the latest version immediately.

zebrad CVE-2026-52731

EUVD-2026-61169 MEDIUM

Uncaught Exception (CWE-248)

2026-07-02 https://github.com/ZcashFoundation/zebra

GHSA-qv2r-v3mx-f4pf

Information Disclosure

6.5

CVSS 3.1 · Vendor: https://github.com/ZcashFoundation/zebra

Severity by source

Vendor (https://github.com/ZcashFoundation/zebra) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

6.5 MEDIUM

Network RPC requires low-privilege authentication (cookie) by default; no confidentiality or integrity impact; complete availability loss via process abort.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (https://github.com/ZcashFoundation/zebra).

CVSS VectorVendor: https://github.com/ZcashFoundation/zebra

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 02, 2026 - 19:52 vuln.today

DescriptionCVE.org

Am I affected

You are affected if:

You run zebrad up to and including v4.4.1.
Your zebrad.toml sets rpc.listen_addr to a TCP address (RPC server is enabled).
An attacker can authenticate to the RPC endpoint. With the default enable_cookie_auth = true, this requires the attacker to read the .cookie file. With enable_cookie_auth = false, any network client reaching the RPC port can trigger it.

Summary

The getblocktemplate RPC handler panics when parsing a LongPollId parameter that contains non-ASCII (multi-byte UTF-8) characters. The handler performs byte-index string slicing on the user-supplied string, which panics in Rust when a byte index falls within a multi-byte character boundary. Because Zebra's release profile sets panic = "abort", the panic terminates the entire node process.

Details

The getblocktemplate handler receives a user-supplied LongPollId string and slices it at fixed byte offsets to extract the encoded tip hash and tip height. When the string contains multi-byte UTF-8 characters, a byte-index slice can land in the middle of a character, causing Rust's str indexing to panic with "byte index is not a char boundary."

Under the panic = "abort" release profile, this panic terminates the entire zebrad process rather than just the RPC task.

Patches

zebra-rpc 8.0.0 and zebrad 4.5.0.

Replace byte-index string slicing with character-aware parsing or validate that the LongPollId string contains only ASCII characters before slicing.

Workarounds

Disable the RPC server by removing rpc.listen_addr from zebrad.toml.
Ensure enable_cookie_auth = true (the default) and restrict filesystem access to the .cookie file.
Place a reverse proxy in front of the RPC port that validates LongPollId parameters are ASCII-only before forwarding.

Impact

A single authenticated RPC request terminates the zebrad process. Same impact profile as GHSA-c8w6-x74f-vmg3: repeatable on restart, affects mining pools and infrastructure that forward getblocktemplate calls.

Credit

Reported by @sangsoo-osec via a private GitHub Security Advisory submission.

AnalysisAI

Process termination via crafted RPC input in zebrad (Zcash Foundation's Zcash node) up to v4.4.1 allows an authenticated network attacker to kill the entire node daemon by submitting a getblocktemplate RPC call with a LongPollId parameter containing multi-byte UTF-8 characters. The root cause is unsafe byte-index string slicing in Rust, which panics when a byte offset lands mid-character; because the release profile sets panic = "abort", this immediately terminates the zebrad process rather than unwinding only the RPC task. No public exploit or active exploitation is identified at time of analysis, but the attack is trivially repeatable on restart, making it a reliable denial-of-service for mining pools and infrastructure dependent on the getblocktemplate workflow.

Technical ContextAI

zebrad is a Rust-based full node implementation for the Zcash blockchain, maintained by the Zcash Foundation (pkg:rust/zebrad, pkg:rust/zebra-rpc). The vulnerable code is in the getblocktemplate RPC handler within the zebra-rpc crate. The handler accepts a LongPollId string parameter and slices it at fixed byte offsets to extract an encoded tip hash and tip height. Rust's str type guarantees UTF-8 validity and panics - rather than returning an error - when a byte-index slice boundary does not align with a character boundary. This is classified as CWE-248 (Uncaught Exception). The Zcash release build sets panic = "abort" in Cargo.toml (referenced at commit d4cd662c), meaning any such panic bypasses Rust's stack unwinding and directly aborts the process at the OS level, taking down the entire node rather than just the offending async task. This is the same failure mode described in the related advisory GHSA-c8w6-x74f-vmg3.

RemediationAI

Upgrade to zebrad 4.5.0 and zebra-rpc 8.0.0, which replace unsafe byte-index string slicing with character-aware parsing or ASCII validation before slicing, as described in the GitHub Security Advisory at https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-qv2r-v3mx-f4pf. If immediate upgrade is not possible, three compensating controls are available with differing trade-offs: first, disable the RPC server entirely by removing rpc.listen_addr from zebrad.toml - this eliminates the attack surface but also disables all RPC-dependent functionality including mining via getblocktemplate; second, ensure enable_cookie_auth = true (already the default) and restrict read access to the .cookie file to only trusted processes, which limits exploitation to attackers with local filesystem access; third, deploy a reverse proxy in front of the RPC port configured to reject or sanitize LongPollId parameter values containing non-ASCII bytes before forwarding - this preserves RPC functionality but adds operational complexity and becomes a new security-critical component.