Zebra before version 6.4.0 contains an uncontrolled resource consumption flaw that allows any connected peer to trigger full proof verification by sending forged block bodies whose header hashes match genuine block headers. By flipping authorizing‑only bytes such as the coinbase scriptSig, an attacker can cause the node to perform unnecessary Sapling, Orchard, and Ironwood proof checks without receiving any penalty. The result is a temporary denial of service, with sync stalls lasting roughly 67 seconds per exploit instance.

The vulnerability affects the Zcash Foundation Zebra blockchain client. Any node running Zebra before version 6.4.0 is vulnerable when it accepts blocks from external peers. Nodes running Zebra 6.4.0 or later are not affected.

This weakness has a CVSS score of 6.3 and is not listed in the CISA KEV catalog. No EPSS data is available, so the probability of exploitation cannot be quantified precisely. The attack can be performed by any unauthenticated peer that establishes a connection to a vulnerable node, making it a network‑based denial of service. While the impact affects only the resource consumption and synchronization of the affected node, it does not compromise data integrity or confidentiality.