The vulnerability originates in Zebra’s checkpoint synchronization logic, where a malicious network peer can cause a denial of service by canceling the verifier rewind after a failed block commit. An attacker can inject a forged block with altered authorizing data and then a restart–triggering block, leading the verifier to discard all subsequent legitimate blocks until the node is restarted. This defect allows the victim to stay permanently out of sync with the network, halting its ability to process new blocks. The weakness aligns with CWE‑460, reflecting improper handling of input data from an external source.

The flaw affects Zcash Foundation’s Zebra software, specifically all releases prior to version 7.0.0. Any system running Zebra 6.x or earlier is vulnerable; no more specific version range is enumerated in the CVE data.

The CVSS score of 8.7 highlights a high severity issue. EPSS data is not available, and the vulnerability is not listed in CISA’s KEV catalog, indicating no widespread active exploitation is reported yet. The likely attack vector is remote, requiring the attacker to act as a peer in the Zebra network. By forging blocks and triggering the problematic rewind logic, an attacker can make the node abandon legitimate blocks, temporarily disabling synchronization and potentially affecting consensus for connected peers. Although no code execution or data compromise occurs, the disruption poses a significant operational risk for nodes that depend on continuous, uninterrupted sync.