CVE-2026-52731

Name of the Vulnerable Software and Affected Versions ZEBRA versions prior to 4.5.0

Description An authenticated attacker can terminate the zebrad node process by sending a malformed request to an enabled RPC endpoint. The getblocktemplate handler panics when parsing a LongPollId parameter containing multi-byte UTF-8 characters. This occurs because the LongPollId::from str() function in zebra-rpc/src/methods/types/long poll.rs uses byte-index string slicing at fixed offsets. If a slice boundary falls within a multi-byte character, it triggers a Rust panic. Since release builds are configured to abort on panic, a single request terminates the entire node process and can be repeated after the node restarts.

Recommendations Update ZEBRA to version 4.5.0. Disable the RPC server by removing rpc.listen addr from the zebrad.toml configuration file. Set enable cookie auth to true and restrict filesystem access to the .cookie file. Implement a reverse proxy in front of the RPC port to validate that LongPollId parameters contain only ASCII characters before forwarding the request.