ZEBRA-RPC · CVE-2026-52731 · Runtime
FIX → 8.0.0 · 4.5.0
A malformed LongPollId string with multi-byte UTF-8 characters makes the getblocktemplate RPC handler panic. Because the release build aborts on panic, the whole zebrad node process stops.
first public May 29, 2026 · 2 sources
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Only nodes that run zebrad up to and including 4.4.1 with the RPC server enabled (rpc.listen_addr set). With default cookie auth, an attacker needs to read the .cookie file first; with cookie auth disabled, any client reaching the RPC port can trigger it. Mining pools and infrastructure that forward getblocktemplate calls are the most likely to be exposed.
Not affected if default-cookie-auth-with-restricted-file-access, managed-hosting, rpc-disabled
Who cares mining-pool, rpc, zcash, zebrad
zebrad --version and compare against 4.4.1 and 4.5.0.zebrad.toml for rpc.listen_addr; the RPC server is only exposed if it is set.enable_cookie_auth is (default) and who can read the file.You are affected if:
zebrad up to and including v4.4.1.zebrad.toml sets rpc.listen_addr to a TCP address (RPC server is enabled).enable_cookie_auth = true, this requires the attacker to read the .cookie file. With enable_cookie_auth = false, any network client reaching the RPC port can trigger it.The getblocktemplate RPC handler panics when parsing a LongPollId parameter that contains non-ASCII (multi-byte UTF-8) characters. The handler performs byte-index string slicing on the user-supplied string, which panics in Rust when a byte index falls within a multi-byte character boundary. Because Zebra's release profile sets panic = "abort", the panic terminates the entire node process.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
true.cookieUpgrade to 8.0.0 · 4.5.0
zebrad 4.5.0zebra-rpc 8.0.0The getblocktemplate handler receives a user-supplied LongPollId string and slices it at fixed byte offsets to extract the encoded tip hash and tip height. When the string contains multi-byte UTF-8 characters, a byte-index slice can land in the middle of a character, causing Rust's str indexing to panic with "byte index is not a char boundary."
Under the panic = "abort" release profile, this panic terminates the entire zebrad process rather than just the RPC task.
zebra-rpc 8.0.0 and zebrad 4.5.0.
Replace byte-index string slicing with character-aware parsing or validate that the LongPollId string contains only ASCII characters before slicing.
rpc.listen_addr from zebrad.toml.enable_cookie_auth = true (the default) and restrict filesystem access to the .cookie file.LongPollId parameters are ASCII-only before forwarding.A single authenticated RPC request terminates the zebrad process. Same impact profile as GHSA-c8w6-x74f-vmg3: repeatable on restart, affects mining pools and infrastructure that forward getblocktemplate calls.
Reported by @sangsoo-osec via a private GitHub Security Advisory submission.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
GitHub Advisory Database, CC-BY 4.0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.