CVE-2026-52731: zebrad has full node denial of service via non-ASCII LongPollId in getblocktemplate

July 2, 2026

The getblocktemplate RPC handler panics when parsing a LongPollId parameter that contains non-ASCII (multi-byte UTF-8) characters. The handler performs byte-index string slicing on the user-supplied string, which panics in Rust when a byte index falls within a multi-byte character boundary. Because Zebra’s release profile sets panic = "abort", the panic terminates the entire node process.

References

github.com/ZcashFoundation/zebra/blob/d4cd662c716382f6397d2a730148025a1ca79fec/Cargo.toml
github.com/ZcashFoundation/zebra/security/advisories/GHSA-qv2r-v3mx-f4pf
github.com/advisories/GHSA-qv2r-v3mx-f4pf
nvd.nist.gov/vuln/detail/CVE-2026-52731

Code Behaviors & Features

Detect and mitigate CVE-2026-52731 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →