Zebra failed to enforce consensus rules that limit valid sighash hash types for V5 transactions introduced by NU5, allowing the node to accept transactions that other Zcash implementations deem invalid. Additionally, Zebra used the canonical hash type for V4 transactions instead of the raw value specified by the protocol, further diverging from the network consensus. These deviations can cause a Zebra node to mine blocks that are considered invalid by zcashd nodes, creating a split in the blockchain and risking double‑spend or orphaned blocks. The vulnerability is rooted in CWE‑573: Incomplete Definition of Countermeasure.

The issue affects ZcashFoundation’s Zebra node implementations before versions 4.3.1 of zebrad and 5.0.2 of zebra‑script. Existing installations of these components that have not been upgraded are vulnerable.

The CVSS score of 9.3 indicates a critical impact, yet the EPSS score is unavailable and the flaw is not listed in KEV, suggesting the threat of exploitation is currently unverified. The likely attack vector is a malicious or compromised node that intentionally broadcasts blocks containing transactions that violate the updated sighash rules, exploiting the mismatch to trigger a consensus split. The outcome would be a diverted chain or degraded network stability, exposing participants to potential loss of funds or delayed confirmations.