CVE-2026-52739

Name of the Vulnerable Software and Affected Versions ZEBRA versions prior to 4.5.0

Description A malicious block producer can cause the zebrad process to terminate by placing the same shielded transaction in a non-finalized parent block and its child. In the Chain::push function within zebra-state/src/service/non finalized state/chain.rs, the software inserts the transaction hash into tx loc by hash and asserts uniqueness before performing shielded data updates and duplicate nullifier checks for Sprout, Sapling, or Orchard. Because release builds use a panic-equals-abort profile, the triggered assertion terminates the entire node process. This occurs because the uniqueness assertion fires before the contextual validation can cleanly reject the duplicate transaction. Exploitation requires either two consecutive attacker-mined blocks or an attacker-mined child block immediately following an honest block that included the attacker's shielded transaction.

Recommendations Update ZEBRA to version 4.5.0.