An authenticated RPC user can crash a ZEBRA node by sending a malformed LongPollId in a getblocktemplate request that contains multi‑byte UTF‑8 characters. The parser slices fixed byte ranges without verifying character boundaries, causing a panic due to an invalid byte index. In release builds this panic is treated as an abort, terminating the entire node process. The vulnerability is a classic example of a programming error in input handling (CWE‑248) and results in a denial of service, not data tampering. The crash can be repeated after a node restart, repeatedly disrupting service availability.

The issue affects ZcashFoundation's ZEBRA and zebra‑rpc implementations when the RPC interface is enabled. All versions prior to 4.5.0 are vulnerable; the fix was introduced in release 4.5.0. An impacted deployment thus consists of any full ZEC node running Zebra with RPC enabled and using an older release.

The CVSS score of 6.5 indicates a moderate severity. An attacker requires valid RPC credentials, which can be acquired through legitimate access or credential compromise. Once authenticated, the attacker can send the crafted request over the network. The EPSS score is not available, but the lack of a known public exploit and absence from the KEV catalog suggest moderate but not immediate threat. Nonetheless, if RPC access is exposed, the downtime caused by successive node restarts can be significant.