Executive brief
Zebra, a Zcash node implementation, is vulnerable to a denial-of-service attack that can crash the software. A malicious actor can trigger this by mining or broadcasting specific types of transactions that cause the node to encounter an internal error and shut down. This affects the availability of the node, requiring a manual restart to restore service.
Technical details
A vulnerability exists in the `Chain::push` function within the `zebra-state` non-finalized state logic. The component updates the transaction-location index (`tx_loc_by_hash`) using an `assert_eq!` check for uniqueness before performing shielded-nullifier validation. If a child block repeats a shielded transaction from its non-finalized parent, the assertion fails and triggers a `panic = "abort"`, terminating the process. Attackers can exploit this by mining two consecutive blocks or by broadcasting a transaction to the mempool and mining a follow-up block after an honest miner includes it. The issue is fixed in `zebrad` v4.5.0 and `zebra-state` v7.0.0 by replacing the assertion with proper error handling.
Affected products
- ZcashFoundation zebrad <= 4.4.1
- ZcashFoundation zebra-state <= 6.0.0
Timeline
- 2026-05-29: disclosed: Initial report by haxatron
- 2026-07-02: advisory: GitHub Advisory published