{"id":"CVE-2026-52731","kind":"vulnerability","aliases":["CVE-2026-52731","GHSA-qv2r-v3mx-f4pf"],"related":[],"title":"zebrad has full node denial of service via non-ASCII LongPollId in getblocktemplate","description":"### Am I affected\n\nYou are affected if:\n\n1. You run `zebrad` up to and including `v4.4.1`.\n2. Your `zebrad.toml` sets `rpc.listen_addr` to a TCP address (RPC server is enabled).\n3. An attacker can authenticate to the RPC endpoint. With the default `enable_cookie_auth = true`, this requires the attacker to read the `.cookie` file. With `enable_cookie_auth = false`, any network client reaching the RPC port can trigger it.\n\n### Summary\n\nThe `getblocktemplate` RPC handler panics when parsing a `LongPollId` parameter that contains non-ASCII (multi-byte UTF-8) characters. The handler performs byte-index string slicing on the user-supplied string, which panics in Rust when a byte index falls within a multi-byte character boundary. Because Zebra's release profile sets `panic = \"abort\"`, the panic terminates the entire node process.\n\n### Details\n\nThe `getblocktemplate` handler receives a user-supplied `LongPollId` string and slices it at fixed byte offsets to extract the encoded tip hash and tip height. When the string contains multi-byte UTF-8 characters, a byte-index slice can land in the middle of a character, causing Rust's `str` indexing to panic with \"byte index is not a char boundary.\"\n\nUnder the `panic = \"abort\"` release profile, this panic terminates the entire `zebrad` process rather than just the RPC task.\n\n### Patches\n\nzebra-rpc 8.0.0 and zebrad 4.5.0.\n\nReplace byte-index string slicing with character-aware parsing or validate that the `LongPollId` string contains only ASCII characters before slicing.\n\n### Workarounds\n\n- Disable the RPC server by removing `rpc.listen_addr` from `zebrad.toml`.\n- Ensure `enable_cookie_auth = true` (the default) and restrict filesystem access to the `.cookie` file.\n- Place a reverse proxy in front of the RPC port that validates `LongPollId` parameters are ASCII-only before forwarding.\n\n### Impact\n\nA single authenticated RPC request terminates the `zebrad` process. Same impact profile as GHSA-c8w6-x74f-vmg3: repeatable on restart, affects mining pools and infrastructure that forward `getblocktemplate` calls.\n\n### Credit\n\nReported by `@sangsoo-osec` via a private GitHub Security Advisory submission.","summary":"A malformed LongPollId string with multi-byte UTF-8 characters makes the getblocktemplate RPC handler panic. Because the release build aborts on panic, the whole zebrad node process stops.","severity":"medium","cvss":6.5,"epss":0.0053,"exploited":false,"exploited_at":null,"products":[{"name":"zebra-rpc","fixed":["8.0.0"],"affected":"<= 7.0.0","ecosystem":"cargo"},{"name":"zebrad","fixed":["4.5.0"],"affected":"<= 4.4.1","ecosystem":"cargo"}],"ecosystems":["cargo"],"tags":["cwe-248","mining-pool","rpc","runtime","zcash","zebrad"],"not_affected_if":["default-cookie-auth-with-restricted-file-access","managed-hosting","rpc-disabled"],"how_to_check":"- Run `zebrad --version` and compare against `4.4.1` and `4.5.0`.\n- Check `zebrad.toml` for `rpc.listen_addr`; the RPC server is only exposed if it is set.\n- Check whether `enable_cookie_auth` is `true` (default) and who can read the `.cookie` file.","fix":"- `zebrad` `4.5.0`\n- `zebra-rpc` `8.0.0`","status":"open","published_at":"2026-07-02T19:28:03+00:00","first_seen_at":"2026-11-13T02:48:40+00:00","triaged_at":"2026-11-13T02:49:09+00:00","updated_at":"2026-11-13T02:49:09+00:00","category":"runtime","confidence":0.8,"triage":{"at":"2026-11-13T02:49:09Z","model":"claude-haiku-5-5","output":{"fix":"- `zebrad` `4.5.0`\n- `zebra-rpc` `8.0.0`","reach":"network","title":"Zebrad: non-ASCII LongPollId in getblocktemplate crashes the full node","impact":"medium","summary":"A malformed LongPollId string with multi-byte UTF-8 characters makes the getblocktemplate RPC handler panic. Because the release build aborts on panic, the whole zebrad node process stops.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["zebrad","zcash","mining-pool","rpc"],"confidence":0.8,"fix_status":"available","needs_auth":"unknown","worst_case":"Single RPC request crashes the zebrad node process repeatedly.","analyst_note":"","how_to_check":"- Run `zebrad --version` and compare against `4.4.1` and `4.5.0`.\n- Check `zebrad.toml` for `rpc.listen_addr`; the RPC server is only exposed if it is set.\n- Check whether `enable_cookie_auth` is `true` (default) and who can read the `.cookie` file.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["rpc-disabled","managed-hosting","default-cookie-auth-with-restricted-file-access"],"who_is_affected":"Only nodes that run zebrad up to and including 4.4.1 with the RPC server enabled (rpc.listen_addr set). With default cookie auth, an attacker needs to read the .cookie file first; with cookie auth disabled, any client reaching the RPC port can trigger it. Mining pools and infrastructure that forward getblocktemplate calls are the most likely to be exposed.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000861,"input_tokens":5395,"output_tokens":643,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':16A,24A '-248':31B '-52731':17A,25A '-8':48B,159C,241C '1':76C '2':85C '3':99C '4.5.0':297C '8.0.0':294C 'abort':60B,198C,274C 'access':342C 'addr':90C,329C 'address':94C 'advisori':409C 'affect':71C,74C,389C 'ascii':11A,154C,317C,363C 'ascii-on':362C 'attack':101C,118C 'auth':113C,127C,335C 'authent':103C,370C 'awar':307C 'boundari':190C,270C 'build':59B 'byte':46B,157C,165C,181C,188C,222C,239C,245C,264C,300C 'byte-index':164C,244C,299C 'c8w6':383C 'call':397C 'caus':256C 'char':269C 'charact':49B,160C,189C,242C,255C,306C,318C 'character-awar':305C 'client':131C 'contain':151C,236C,315C 'cooki':112C,122C,126C,334C,345C 'credit':398C 'cve':15A,23A 'cwe':30B 'default':110C,338C 'denial':5A 'detail':206C 'disabl':322C 'enabl':98C,111C,125C,333C 'encod':227C 'endpoint':107C 'ensur':332C 'entir':203C,281C 'extract':225C 'f4pf':22A 'fall':183C 'fals':128C 'file':123C,346C 'filesystem':341C 'fix':221C 'forward':366C,395C 'front':352C 'full':3A 'getblocktempl':14A,52B,141C,208C,396C 'ghsa':19A,382C 'ghsa-c8w6-x74f-vmg3':381C 'ghsa-qv2r-v3mx-f4pf':18A 'github':407C 'handler':54B,143C,162C,209C 'hash':229C 'height':232C 'impact':367C,378C 'includ':83C 'index':166C,182C,246C,260C,265C,301C 'infrastructur':393C 'land':249C 'longpollid':12A,41B,148C,215C,313C,359C 'make':50B 'malform':40B 'middl':252C 'mine':33B,390C 'mining-pool':32B 'multi':45B,156C,187C,238C 'multi-byt':44B,155C,186C,237C 'network':130C 'node':4A,66B,204C 'non':10A,153C 'non-ascii':9A,152C 'offset':223C 'osec':403C 'panic':55B,62B,144C,176C,197C,200C,262C,273C,278C 'paramet':149C,360C 'pars':146C,308C 'patch':290C 'perform':163C 'place':347C 'pool':34B,391C 'port':135C,356C 'privat':406C 'process':67B,205C,283C,376C 'profil':195C,276C,379C 'proxi':350C 'qv2r':20A 'rather':284C 'reach':132C 'read':120C 'receiv':210C 'releas':58B,194C,275C 'remov':327C 'repeat':386C 'replac':298C 'report':399C 'request':372C 'requir':116C 'restart':388C 'restrict':340C 'revers':349C 'rpc':28A,35B,53B,95C,106C,134C,142C,288C,293C,324C,355C,371C 'rpc.listen':89C,328C 'run':78C 'runtim':36B 'rust':178C,257C 'sangsoo':402C 'sangsoo-osec':401C 'secur':408C 'server':96C,325C 'servic':7A 'set':88C,196C 'singl':369C 'slice':168C,218C,247C,303C,320C 'stop':68B 'str':259C 'string':42B,167C,174C,216C,235C,302C,314C 'submiss':410C 'summari':139C 'suppli':173C,214C 'task':289C 'tcp':93C 'termin':201C,279C,373C 'tip':228C,231C 'trigger':137C 'true':114C,336C 'user':172C,213C 'user-suppli':171C,212C 'utf':47B,158C,240C 'v3mx':21A 'v4.4.1':84C 'valid':310C,358C 'via':8A,404C 'vmg3':385C 'whole':64B 'within':184C 'workaround':321C 'x74f':384C 'zcash':37B 'zebra':27A,192C,292C 'zebra-rpc':26A,291C 'zebrad':1A,29A,38B,65B,79C,282C,296C,375C 'zebrad.toml':87C,331C","nicknames":[],"mitigations":[],"who_affected":"Only nodes that run zebrad up to and including 4.4.1 with the RPC server enabled (rpc.listen_addr set). With default cookie auth, an attacker needs to read the .cookie file first; with cookie auth disabled, any client reaching the RPC port can trigger it. Mining pools and infrastructure that forward getblocktemplate calls are the most likely to be exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["zebrad","zebrarpc"],"ptokens":["rpc","zebra","zebrad"],"labels":["cargo","cwe248","medium","miningpool","rpc","runtime","zcash","zebrad"],"campaign_type":null,"search_a":"'-2026':16A,24A '-52731':17A,25A 'ascii':11A 'cve':15A,23A 'denial':5A 'f4pf':22A 'full':3A 'getblocktempl':14A 'ghsa':19A 'ghsa-qv2r-v3mx-f4pf':18A 'longpollid':12A 'node':4A 'non':10A 'non-ascii':9A 'qv2r':20A 'rpc':28A 'servic':7A 'v3mx':21A 'via':8A 'zebra':27A 'zebra-rpc':26A 'zebrad':1A,29A","search_b":"'-248':31B '-8':48B 'abort':60B 'build':59B 'byte':46B 'charact':49B 'cwe':30B 'getblocktempl':52B 'handler':54B 'longpollid':41B 'make':50B 'malform':40B 'mine':33B 'mining-pool':32B 'multi':45B 'multi-byt':44B 'node':66B 'panic':55B,62B 'pool':34B 'process':67B 'releas':58B 'rpc':35B,53B 'runtim':36B 'stop':68B 'string':42B 'utf':47B 'whole':64B 'zcash':37B 'zebrad':38B,65B","search_c":"'-8':159C,241C '1':76C '2':85C '3':99C '4.5.0':297C '8.0.0':294C 'abort':198C,274C 'access':342C 'addr':90C,329C 'address':94C 'advisori':409C 'affect':71C,74C,389C 'ascii':154C,317C,363C 'ascii-on':362C 'attack':101C,118C 'auth':113C,127C,335C 'authent':103C,370C 'awar':307C 'boundari':190C,270C 'byte':157C,165C,181C,188C,222C,239C,245C,264C,300C 'byte-index':164C,244C,299C 'c8w6':383C 'call':397C 'caus':256C 'char':269C 'charact':160C,189C,242C,255C,306C,318C 'character-awar':305C 'client':131C 'contain':151C,236C,315C 'cooki':112C,122C,126C,334C,345C 'credit':398C 'default':110C,338C 'detail':206C 'disabl':322C 'enabl':98C,111C,125C,333C 'encod':227C 'endpoint':107C 'ensur':332C 'entir':203C,281C 'extract':225C 'fall':183C 'fals':128C 'file':123C,346C 'filesystem':341C 'fix':221C 'forward':366C,395C 'front':352C 'getblocktempl':141C,208C,396C 'ghsa':382C 'ghsa-c8w6-x74f-vmg3':381C 'github':407C 'handler':143C,162C,209C 'hash':229C 'height':232C 'impact':367C,378C 'includ':83C 'index':166C,182C,246C,260C,265C,301C 'infrastructur':393C 'land':249C 'longpollid':148C,215C,313C,359C 'middl':252C 'mine':390C 'multi':156C,187C,238C 'multi-byt':155C,186C,237C 'network':130C 'node':204C 'non':153C 'non-ascii':152C 'offset':223C 'osec':403C 'panic':144C,176C,197C,200C,262C,273C,278C 'paramet':149C,360C 'pars':146C,308C 'patch':290C 'perform':163C 'place':347C 'pool':391C 'port':135C,356C 'privat':406C 'process':205C,283C,376C 'profil':195C,276C,379C 'proxi':350C 'rather':284C 'reach':132C 'read':120C 'receiv':210C 'releas':194C,275C 'remov':327C 'repeat':386C 'replac':298C 'report':399C 'request':372C 'requir':116C 'restart':388C 'restrict':340C 'revers':349C 'rpc':95C,106C,134C,142C,288C,293C,324C,355C,371C 'rpc.listen':89C,328C 'run':78C 'rust':178C,257C 'sangsoo':402C 'sangsoo-osec':401C 'secur':408C 'server':96C,325C 'set':88C,196C 'singl':369C 'slice':168C,218C,247C,303C,320C 'str':259C 'string':167C,174C,216C,235C,302C,314C 'submiss':410C 'summari':139C 'suppli':173C,214C 'task':289C 'tcp':93C 'termin':201C,279C,373C 'tip':228C,231C 'trigger':137C 'true':114C,336C 'user':172C,213C 'user-suppli':171C,212C 'utf':158C,240C 'v4.4.1':84C 'valid':310C,358C 'via':404C 'vmg3':385C 'within':184C 'workaround':321C 'x74f':384C 'zebra':192C,292C 'zebra-rpc':291C 'zebrad':79C,282C,296C,375C 'zebrad.toml':87C,331C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-05-29T07:43:27+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-qv2r-v3mx-f4pf","url":"https://github.com/advisories/GHSA-qv2r-v3mx-f4pf","severity":"medium","published_at":"2026-07-02T19:28:03+00:00","modified_at":"2026-11-13T02:44:07+00:00","first_seen_at":"2026-11-13T02:48:40+00:00","fetched_at":"2026-11-13T02:52:49+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-52731","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-52731","severity":null,"published_at":"2026-08-18T20:17:16+00:00","modified_at":"2026-11-09T20:10:00+00:00","first_seen_at":"2026-11-13T03:13:22+00:00","fetched_at":"2026-11-13T03:13:22+00:00","note":null}],"documents":[{"id":142081,"url":"https://api.github.com/repos/ZcashFoundation/zebra/security-advisories/GHSA-qv2r-v3mx-f4pf","title":"Maintainer's advisory: api.github.com","kind":"vendor","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Maintainer's advisory: api.github.com"},{"id":142082,"url":"https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-qv2r-v3mx-f4pf","title":"Maintainer's advisory: github.com","kind":"vendor","source":"ghsa","publisher":"vendor","text":null,"published_at":"2026-05-29T07:43:27+00:00","relation":"advisory","confidence":null,"note":"Maintainer's advisory: github.com"},{"id":142266,"url":"https://github.com/ZcashFoundation/zebra/commit/1440b43ca7df59aca948090d45117557b217a6cd","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":142267,"url":"https://github.com/ZcashFoundation/zebra/releases/tag/v4.5.0","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"}],"disclosures":[],"exploit_sources":[{"type":"epss","score":0.0053,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-52731"}],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}