CVE-2026-52736

Name of the Vulnerable Software and Affected Versions ZEBRA versions prior to 4.5.0

Description A remote unauthenticated P2P peer can stall a Zcash node by racing an invalid block body against a valid canonical body for the same block header hash. This is possible because ZIP-244 allows an attacker to mutate coinbase scriptSig authentication data while maintaining the same transaction identifiers, merkle root, and block header hash. In the queue and commit to non finalized state function within zebra-state/src/service.rs, the node records the hash in non finalized block write sent hashes before contextual validation is complete. If the poisoned body is rejected, the hash is not removed from the cache. When the honest body subsequently arrives, the node identifies the cached hash as a duplicate via KnownBlock::WriteChannel and suppresses it, leaving the node stuck at a specific block height until a restart or reorganization occurs.

Recommendations Update ZEBRA to version 4.5.0 or later. As a temporary mitigation, restart the node to clear the in-memory sent-hash cache and allow the valid block to be re-fetched.