Zebra's JSON‑RPC HTTP middleware treats a truncated request as an unrecoverable error and aborts the node. As a result, an authenticated RPC client can cause the node to crash by disconnecting before the full request body arrives, leading to a denial of service. The weakness is a failure to gracefully handle partial input (CWE‑248) and an inadequate check for correctly formatted requests (CWE‑617).

ZcashFoundation's Zebra node is affected. Specifically, zebrad versions 2.2.0 through 4.3.0 and zebra‑rpc versions 1.0.0‑beta.45 through 6.0.1 are vulnerable. Versions 4.3.1 of zebrad and 6.0.2 of zebra‑rpc include the fix.

With a CVSS score of 6.9, the vulnerability presents moderate severity. Because it requires an authenticated client, full exploitation still demands valid RPC credentials, but an attacker with those credentials can reliably cause a node crash. EPSS is not published, and the flaw is not listed in CISA’s KEV catalog, indicating no confirmed exploits yet. Nevertheless, the capability to crash a node warrants timely patching.