Zebra DoS via non-ASCII LongPollId in getblocktemplate RPC (CVE-2025-52711)

Vulnerability Overview Vulnerability Name: Full node denial of service via non-ASCII LongPollId in getblocktemplate Vulnerability Description: When parsing the parameter containing non-ASCII (multi-byte UTF-8) characters, the RPC handler triggers a panic. Since Rust causes a panic when using a that falls on a multi-byte character boundary, and Zebra's release profile is configured with , this panic terminates the entire node process. Scope of Impact Affected Versions: - : <= 7.0.0 - : <= 4.4.1 Fixed Versions: - : 8.0.0 - : 4.5.0 CVSS v3 Base Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Confidentiality: None - Integrity: None - Availability: High CVE ID: CVE-2025-52711 Remediation 1. Replace byte-indexed string slicing: Use character-aware parsing or validate that the string contains only ASCII characters before slicing. 2. Temporary Mitigations: - Disable the RPC server by removing from . - Ensure (the default value) and restrict filesystem access to the file. - Place a reverse proxy in front of the RPC port to validate that the parameter consists of ASCII characters before forwarding the request. Impact A single authenticated RPC request will terminate the process. The same attack profile remains effective after a restart, affecting mining pools and infrastructure that forwards calls. References CWE-617: Reachable Assertion CWE-130: Incorrect Calculation of Multi-Byte String Length Zebra Cargo.toml at 0c08f62c: in release profile. Credits Reported by @sangwoo-osoc via a private GitHub Security Advisory.

Goal Reached Thanks to every supporter — we hit 100%!

Zebra DoS via non-ASCII LongPollId in getblocktemplate RPC (CVE-2025-52711)

More from this source