CVE-2026-52737

🗓️ 18 Aug 2026 19:19:09Reported by GitHub_MType

cve🔗 web.nvd.nist.gov👁 41 Views🌐 WEB

Zebra pre-4.5.0 DoS via sync restart poisoning from unauthenticated P2P peer serving above-lookahead blocks.

Reporter	Title	Published	Views	Family All 7
Cvelist	CVE-2026-52737 ZEBRA: Sync restart poisoning from single unauthenticated peer via above-lookahead block	18 Aug 202619:19	–	cvelist
EUVD	EUVD-2026-61163	18 Aug 202619:19	–	euvd
Github Security Blog	Zebra has sync restart poisoning from single unauthenticated peer via above-lookahead block	2 Jul 202619:44	–	github
NVD	CVE-2026-52737	18 Aug 202620:17	–	nvd
OSV	GHSA-GVJC-3W7C-92JX Zebra has sync restart poisoning from single unauthenticated peer via above-lookahead block	2 Jul 202619:44	–	osv
Positive Technologies	PT-2026-55473	2 Jul 202600:00	–	ptsecurity
Vulnrichment	CVE-2026-52737 ZEBRA: Sync restart poisoning from single unauthenticated peer via above-lookahead block	18 Aug 202619:19	–	vulnrichment

Vulners

Node

gnu zebraRange<4.5.0

zfnd zebra-consensusRange<7.0.0

[
  {
    "vendor": "ZcashFoundation",
    "product": "zebra",
    "versions": [
      {
        "version": "< 4.5.0",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "ZcashFoundation",
    "product": "zebra-consensus",
    "versions": [
      {
        "version": "< 7.0.0",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/ZcashFoundation/zebra/commit/bc64dfe45746a86d14546a0a5a766387dd5a2942
github	www.github.com/ZcashFoundation/zebra/pull/10647
github	www.github.com/ZcashFoundation/zebra/releases/tag/v4.5.0
github	www.github.com/ZcashFoundation/zebra/security/advisories/GHSA-gvjc-3w7c-92jx
github	www.github.com/ZcashFoundation/zebra/commit/1440b43ca7df59aca948090d45117557b217a6cd

Parameter	Position	Path	Description	CWE
inventory	request body	getblocks	Unauthenticated P2P peer can respond to outbound getblocks with a small two-hash inventory and serve a syntactically valid block with a high coinbase height, triggering sync restart behavior.	CWE-345
inventory	request body	FindBlocks	Unauthenticated P2P peer can respond to FindBlocks with a small two-hash inventory and serve a syntactically valid block with a high coinbase height, triggering restart/sync degradation.	CWE-345

18 Aug 2026 20:17Current

5.3Medium risk

Vulners AI Score5.3

CVSS 3.15.3

EPSS0.00203

SSVC

CWE-345