CVE-2026-52733

The record

ZEBRA is a Zcash node written entirely in Rust. Prior to 4.5.0, a natural or attacker-influenced chain fork can leave stale Sapling and Orchard note-commitment subtree roots in Zebra state. In zebra-state/src/service/non_finalized_state/chain.rs, Chain::pop_tip removed a reverted tip block but did not remove subtree entries whose end_height belonged to that block, unlike the cleanup performed by pop_root. When the winning fork later finalized, the abandoned branch's stale subtree data could be written to RocksDB and survive node restarts. The corrupted history can cause z_getsubtreesbyindex consumers such as lightwalletd and light wallets to receive incorrect subtree roots, producing wallet synchronization failures or incorrect wallet state and requiring a full state rebuild for recovery. This issue is fixed in version 4.5.0.

Affected packages

Related vulnerabilities

• CVE-2026-109276 ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains an incomplete cleanup flaw… CWE-459
• CVE-2026-15390 Das U-Boot with CONFIG_IP_DEFRAG=y parameter fails to clear IP reassembly state after… CWE-459
• CVE-2026-88932 multer is a Node.js middleware for handling multipart/form-data uploads. CWE-459
• CVE-2026-87776 compression is a Node.js and Express compression middleware. CWE-459
• CVE-2026-87549 Incomplete cleanup in Downloads in Google Chrome prior to 153.0.8010.36 allowed a remote… CWE-459
• CVE-2026-87446 Incomplete cleanup in Extensions in Google Chrome prior to 153.0.8010.36 allowed a remote… CWE-459
• CVE-2026-87436 Incomplete cleanup in Browser in Google Chrome prior to 153.0.8010.36 allowed a remote… CWE-459
• CVE-2026-85043 Incomplete cleanup in Network in Google Chrome prior to 152.0.7977.82 allowed a remote… CWE-459