CVE-2026-52733

Name of the Vulnerable Software and Affected Versions ZEBRA versions prior to 4.5.0

Description A chain fork, whether natural or attacker-influenced, can cause stale Sapling and Orchard note-commitment subtree roots to remain in the Zebra state. In the zebra-state/src/service/non finalized state/chain.rs file, the Chain::pop tip() function removes a reverted tip block but fails to remove subtree entries associated with that block's end height, creating an asymmetry with the pop root() function which performs this cleanup correctly. When the winning fork is finalized, this stale data is written to RocksDB, a persistent key-value store, allowing the corruption to survive node restarts. This corrupted history can lead consumers of the z getsubtreesbyindex endpoint, such as light wallets and lightwalletd, to receive incorrect subtree roots, resulting in wallet synchronization failures or incorrect wallet states.

Recommendations Update ZEBRA to version 4.5.0.