CVE-2026-52738

Name of the Vulnerable Software and Affected Versions ZEBRA versions prior to 4.4.2

Description A consensus-valid block containing a long chain of transparent self-spends to a single address can cause Zebra nodes to permanently halt. In the file zebra-state/src/service/finalized state/zebra db/transparent.rs, the finalized-state writer processes all newly created outputs as credits before applying spent-output debits from the same block. This credit-first ordering can cause the intermediate per-address balance to exceed MAX MONEY (the maximum supply cap of the currency), triggering an expect-based panic that terminates the process under the panic equals abort release profile. Since the triggering block is accepted by other nodes like zcashd, the Zebra node encounters the same block upon every restart, resulting in a persistent halt. An attacker with mining capabilities and approximately 1,100 to 2,100 ZEC can construct such a block to disrupt service for downstream consumers, including light wallets and exchanges.

Recommendations Update ZEBRA to version 4.4.2 or later.