Zebra before 7.0.0 contains an inefficient algorithmic complexity flaw that enables unauthenticated peers to submit transactions with tens of thousands of transparent inputs. The resulting quadratic re‑calculation of ZIP‑244 or ZIP‑243 digests stalls the Rayon‑backed block verification threads for several minutes, effectively denying service to the node. This vulnerability is classified as CWE‑407.

The affected product is ZcashFoundation Zebra, versions prior to 7.0.0. Any installation of Zebra running a pre‑7.0.0 build is susceptible.

The CVSS score of 8.7 marks this issue as high severity. Because the exploit can be performed by any peer without authentication, an attacker can easily send the large‑input transactions over the network. The EPSS score is not available and the vulnerability is not listed in CISA KEV, but the lack of authentication and the extreme resource usage make it attractive for a distributed denial‑of‑service attack. Exploitation simply requires broadcasting invalid transactions through the peer network, which triggers the quadratic computation and pauses block processing.