This CVE demonstrates a denial‑of‑service vulnerability in Zebra’s block discovery pipeline that permits an unauthenticated remote attacker to permanently halt all new block discovery on a targeted node. The flaw arises from uncontrolled resource exhaustion (CWE‑770) within the gossip, syncer, and download subsystems, causing a monotonically increasing block deficit that never self‑heals. As a result, the affected node becomes unable to receive or process new blocks, essentially destroying its ability to stay in sync with the Zcash network.

The vulnerability impacts the Zcash Foundation’s Zebra node software versions prior to 4.4.0. Any deployment of Zebra 4.3.x or earlier is susceptible, as the patch introducing protection was added in the 4.4.0 release.

The CVSS score of 8.7 indicates a high severity denial‑of‑service risk. No EPSS data is available, and the vulnerability is not recorded in the CISA KEV catalog. It is exploitable via a single TCP connection from an unauthenticated attacker, meaning that any external host able to reach the Zebra node can initiate the attack without credentials. The impact span is the entire block discovery process of the node, leading to network disconnect from its peers and loss of up‑to‑date block data.