Zebra (zebrad) before version 6.3.0 contains logic that reads a block’s height directly from its coinbase transaction’s scriptSig, which is not validated before use. When a node receives a block whose claimed height is far behind the current tip, it drops that block before the block undergoes consensus validation and does not penalize the peer that supplied it. An attacker who can serve a forged coinbase transaction can repeatedly provide a canonical block that claims height 1 while maintaining the hash that a node is expected to download, causing the node to ignore newer blocks and delaying its discovery of the latest block. The result is a denial of service for the affected node, preventing it from keeping pace with the network. The impact is a loss of availability for that node and its services.

ZcashFoundation’s Zebra (zebrad) software versions older than 6.3.0 are affected. All installations running a pre‑6.3.0 Zebra binary are potentially vulnerable if they accept arbitrary peers to provide block data.

The vulnerability scores a CVSS of 8.7, indicating a high severity. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, meaning no public evidence of exploitation is recorded. The attack vector is remote and relies on a network peer; an attacker can control a malicious peer to feed a node the forged block, or take advantage of a not‑trusted peer supply. While the exploit requires an unauthenticated connection to the node, most public or private Zebrad instances are reachable by other network participants. The combination of high severity and the ease of forging the block makes this vulnerability serious for operators who run untrusted or poorly filtered peers.