---
id: "CVE-2026-52731"
page: "https://infrastack.ai/live/CVE-2026-52731"
kind: "vulnerability"
aliases: ["CVE-2026-52731", "GHSA-qv2r-v3mx-f4pf"]
title: "zebrad has full node denial of service via non-ASCII LongPollId in getblocktemplate"
severity: "medium"
cvss: 6.5
epss: 0.0053
exploited: false
status: "open"
category: "runtime"
products: [{"name": "zebra-rpc", "fixed": ["8.0.0"], "affected": "<= 7.0.0", "ecosystem": "cargo"}, {"name": "zebrad", "fixed": ["4.5.0"], "affected": "<= 4.4.1", "ecosystem": "cargo"}]
ecosystems: ["cargo"]
tags: ["cwe-248", "mining-pool", "rpc", "runtime", "zcash", "zebrad"]
not_affected_if: ["default-cookie-auth-with-restricted-file-access", "managed-hosting", "rpc-disabled"]
published_at: "2026-07-02T19:28:03+00:00"
first_seen_at: "2026-11-13T02:48:40+00:00"
updated_at: "2026-11-13T02:49:09+00:00"
sources: [{"source": "ghsa", "url": "https://github.com/advisories/GHSA-qv2r-v3mx-f4pf", "first_seen_at": "2026-11-13T02:48:40+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-52731", "first_seen_at": "2026-11-13T03:13:22+00:00"}]
exploit_sources: [{"type": "epss", "score": 0.0053, "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-52731"}]
---

# zebrad has full node denial of service via non-ASCII LongPollId in getblocktemplate

Link for people: https://infrastack.ai/live/CVE-2026-52731 (this .md is for agents)

A malformed LongPollId string with multi-byte UTF-8 characters makes the getblocktemplate RPC handler panic. Because the release build aborts on panic, the whole zebrad node process stops.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- cargo:zebra-rpc affected <= 7.0.0 fixed 8.0.0
- cargo:zebrad affected <= 4.4.1 fixed 4.5.0

## How to check

- Run `zebrad --version` and compare against `4.4.1` and `4.5.0`.
- Check `zebrad.toml` for `rpc.listen_addr`; the RPC server is only exposed if it is set.
- Check whether `enable_cookie_auth` is `true` (default) and who can read the `.cookie` file.

## Fix

- `zebrad` `4.5.0`
- `zebra-rpc` `8.0.0`

## Timeline

- 2026-11-13T02:48:40+00:00 ghsa https://github.com/advisories/GHSA-qv2r-v3mx-f4pf
- 2026-11-13T03:13:22+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-52731

## Documents

- [advisory] Maintainer's advisory: api.github.com https://api.github.com/repos/ZcashFoundation/zebra/security-advisories/GHSA-qv2r-v3mx-f4pf
- [advisory] Maintainer's advisory: github.com https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-qv2r-v3mx-f4pf
- [fix] Patch: github.com https://github.com/ZcashFoundation/zebra/commit/1440b43ca7df59aca948090d45117557b217a6cd
- [fix] Release notes: github.com https://github.com/ZcashFoundation/zebra/releases/tag/v4.5.0

## From the sources

### Am I affected

You are affected if:

1. You run `zebrad` up to and including `v4.4.1`.
2. Your `zebrad.toml` sets `rpc.listen_addr` to a TCP address (RPC server is enabled).
3. An attacker can authenticate to the RPC endpoint. With the default `enable_cookie_auth = true`, this requires the attacker to read the `.cookie` file. With `enable_cookie_auth = false`, any network client reaching the RPC port can trigger it.

### Summary

The `getblocktemplate` RPC handler panics when parsing a `LongPollId` parameter that contains non-ASCII (multi-byte UTF-8) characters. The handler performs byte-index string slicing on the user-supplied string, which panics in Rust when a byte index falls within a multi-byte character boundary. Because Zebra's release profile sets `panic = "abort"`, the panic terminates the entire node process.

### Details

The `getblocktemplate` handler receives a user-supplied `LongPollId` string and slices it at fixed byte offsets to extract the encoded tip hash and tip height. When the string contains multi-byte UTF-8 characters, a byte-index slice can land in the middle of a character, causing Rust's `str` indexing to panic with "byte index is not a char boundary."

Under the `panic = "abort"` release profile, this panic terminates the entire `zebrad` process rather than just the RPC task.

### Patches

zebra-rpc 8.0.0 and zebrad 4.5.0.

Replace byte-index string slicing with character-aware parsing or validate that the `LongPollId` string contains only ASCII characters before slicing.

### Workarounds

- Disable the RPC server by removing `rpc.listen_addr` from `zebrad.toml`.
- Ensure `enable_cookie_auth = true` (the default) and restrict filesystem access to the `.cookie` file.
- Place a reverse proxy in front of the RPC port that validates `LongPollId` parameters are ASCII-only before forwarding.

### Impact

A single authenticated RPC request terminates the `zebrad` process. Same impact profile as GHSA-c8w6-x74f-vmg3: repeatable on restart, affects mining pools and infrastructure that forward `getblocktemplate` calls.

### Credit

Reported by `@sangsoo-osec` via a private GitHub Security Advisory submission.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_