Zebra’s block validator fails to count all transparent signature operations when evaluating a block, allowing blocks that exceed the 20,000‑operation limit to be accepted by Zebra but rejected by other Zcash implementations. A miner can therefore produce a block that Zebra will accept and others will refuse, creating a divergence in the blockchain.

All Zebra nodes running any version earlier than 4.4.0 are vulnerable. The patch that corrects the sigop counting logic is contained in Zebra v4.4.0 and later.

The CVSS score of 9.2 indicates a critical risk. EPSS data is unavailable, and the vulnerability is not listed in the CISA KEV catalog, which does not reduce its severity. The flaw can be exploited without special access; any miner or individual capable of submitting a block with an inflated signature‑operation count can trigger the issue. Acceptance of such a block by Zebra nodes would cause them to diverge from the broader Zcash network, leading to a network split.