A logic error in Zebra’s transaction verification cache allows a malicious miner to inject a block that appears to contain a valid transaction but carries invalid authorization data. Although the invalid transaction itself is not accepted, the block can be considered valid by vulnerable nodes, resulting in a consensus split with other Zcash nodes. This flaw does not the allow arbitrary code execution or data disclosure but can disrupt network integrity and reduce the reliability of affected nodes.

ZcashFoundation’s Zebra node software and its accompanying zebra‑consensus component are impacted. Any installation of zebrad versions earlier than 4.3.0 or zebra‑consensus earlier than 5.0.1 is vulnerable. Modern releases that meet or exceed these version thresholds have the issue patched.

The vulnerability carries a CVSS score of 8.4, indicating high severity, but the EPSS score is below 1 %, suggesting a low likelihood of exploitation in the wild. It is not listed in the CISA KEV catalog. Exploitation requires a malicious miner generating a forged block that the node will accept due to the cache logic flaw; the attacker must be able to breed the node into accepting the block through normal network communication. The lack of a direct denial of service or privilege escalation barrier means that while system integrity is compromised, the vulnerability may be difficult to trigger without the attacker’s participation in the consensus process.