Zebra prior to version 6.4.0 performs insufficient integrity validation on gossip traffic. An attacker can craft a real block with a coinbase scriptSig rewritten to height 1 while preserving the ZIP‑244 block hash, causing the node to drop the block before consensus validation. The drop prevents the node from advancing its tip, delaying discovery of new blocks for mining backends and resulting in a DoS of the node’s block propagation and mining capabilities.

The affected product is Zcash Foundation Zebra. All versions earlier than 6.4.0, including the released 6.3.x releases, are impacted.

The CVSS base score of 6.3 indicates a medium severity vulnerability. EPSS is not available, so the probability of exploitation cannot be precisely quantified. The vulnerability is not listed in the CISA KEV catalog. The attack vector requires an unauthenticated peer connection, so any black‑hat node connected to the network could attempt to force the block drop. Given the medium CVSS score and the absence of known exploit prevalence, the overall risk is moderate, but it can be mitigated by a patch or by controlling peer trust.