Executive brief
A vulnerability in the Zebra Zcash node software allows a single malicious user to repeatedly stall the synchronization process of other nodes. By sending specially crafted but invalid block information, an attacker can force a node to restart its entire sync cycle every 67 seconds. This results in a significant degradation of service, preventing the node from staying up to date with the blockchain network.
Technical details
The vulnerability exists in the interaction between Zebra's syncer and its error handling logic. A malicious peer can provide a syntactically valid block with a coinbase height far above the victim's local tip, triggering an 'AboveLookaheadHeightLimit' error. Because this specific error variant does not carry the advertiser's peer address, the syncer fails to penalize the offending peer and instead defaults to a global sync restart. This restart cancels all in-flight downloads from honest peers and imposes a 67-second delay. The attack requires only an unauthenticated P2P connection and can be repeated indefinitely. The issue is fixed in Zebra 4.4.2 by ensuring peer addresses are tracked through height-related errors and making such failures peer-local rather than global.
Affected products
- Zcash Foundation zebrad <= 4.4.1
- Zcash Foundation zebra-consensus <= 6.0.0
Timeline
- 2026-05-29: disclosed
- 2026-07-02: advisory