Executive brief
A vulnerability in Zebra, a software node for the Zcash cryptocurrency network, allows a remote attacker to permanently stop the node from receiving new transaction blocks. By exploiting weaknesses in how the software communicates with peers, an attacker can force a node to fall behind the rest of the network indefinitely. This results in a total service outage for the affected node that requires manual intervention by an administrator to fix.
Technical details
The vulnerability stems from three independent weaknesses in Zebra's gossip, syncer, and download subsystems. First, the gossip path lacked per-connection rate limiting on 'inv' messages, allowing an attacker to saturate the download queue with fake hashes. Second, the system silently ignored queue-full errors, dropping legitimate announcements. Third, the syncer path could be poisoned by providing empty responses to block discovery queries, which carried no misbehavior penalty and did not trigger a peer ban. By combining these vectors from a single TCP connection, an attacker can suppress all block discovery mechanisms, causing the node to fall permanently behind the chain tip. This is fixed in version 4.4.0 by implementing stricter peer validation and dropping connections that provide empty responses to sync requests.
Affected products
- Zcash Foundation Zebra (zebrad) < 4.4.0
Timeline
- 2026-05-05: disclosed
- 2026-05-08: advisory
- 2026-05-08: patched