CVE-2026-52736

{"id": "CVE-2026-52736", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-52736", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-18T19:38:19.383112Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.7, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "ZcashFoundation", "product": "zebra", "versions": [{"status": "affected", "version": "< 4.5.0"}]}]}], "published": "2026-08-18T20:17:17.400", "references": [{"url": "https://github.com/ZcashFoundation/zebra/commit/1440b43ca7df59aca948090d45117557b217a6cd", "source": "security-advisories@github.com"}, {"url": "https://github.com/ZcashFoundation/zebra/releases/tag/v4.5.0", "source": "security-advisories@github.com"}, {"url": "https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-4m69-67m6-prqp", "source": "security-advisories@github.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Primary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-459"}]}], "descriptions": [{"lang": "en", "value": "ZEBRA is a Zcash node written entirely in Rust. Prior to 4.5.0, a remote unauthenticated P2P peer can stall a Zebra node by racing an invalid block body against the valid canonical body for the same block header hash. ZIP-244 permits the attacker to mutate coinbase scriptSig authentication data while retaining the transaction identifiers, merkle root, and block header hash, so the poisoned body fails later commitment validation but shares the canonical hash. In zebra-state/src/service.rs, queue_and_commit_to_non_finalized_state recorded the hash in non_finalized_block_write_sent_hashes before contextual validation completed and did not remove it when the write task rejected the body. When the honest body later arrived, the cached hash caused KnownBlock::WriteChannel duplicate handling to suppress it, leaving the node stuck one height behind until restart or reorganization. This issue is fixed in version 4.5.0."}, {"lang": "es", "value": "ZEBRA es un nodo Zcash escrito completamente en Rust. Antes de la versi\u00f3n 4.5.0, un par P2P remoto no autenticado puede paralizar un nodo Zebra al competir con un cuerpo de bloque inv\u00e1lido contra el cuerpo can\u00f3nico v\u00e1lido para el mismo hash del encabezado del bloque. ZIP-244 permite al atacante mutar los datos de autenticaci\u00f3n del scriptSig de coinbase mientras retiene los identificadores de transacci\u00f3n, la ra\u00edz Merkle y el hash del encabezado del bloque, de modo que el cuerpo envenenado falla en la validaci\u00f3n de compromiso posterior pero comparte el hash can\u00f3nico. En zebra-state/src/service.rs, queue_and_commit_to_non_finalized_state registr\u00f3 el hash en non_finalized_block_write_sent_hashes antes de que se completara la validaci\u00f3n contextual y no lo elimin\u00f3 cuando la tarea de escritura rechaz\u00f3 el cuerpo. Cuando el cuerpo honesto lleg\u00f3 m\u00e1s tarde, el hash en cach\u00e9 hizo que el manejo de duplicados de KnownBlock::WriteChannel lo suprimiera, dejando el nodo atascado una altura atr\u00e1s hasta el reinicio o la reorganizaci\u00f3n. Este problema est\u00e1 solucionado en la versi\u00f3n 4.5.0."}], "lastModified": "2026-10-22T22:10:00.250", "sourceIdentifier": "security-advisories@github.com"}