Zebra can mistakenly accept blocks containing P2SH spends whose signature‑operation count is underestimated because its pure‑Rust parser stops parsing at disabled opcodes. The reference implementation counts all signatures, so the validated block may exceed the 20,000‑sigop limit. The mismatch lets an attacker broadcast crafted transactions that Zebra believes are valid while the rest of the network rejects the block, creating a temporary chain split that undermines network integrity and availability.

The vulnerability affects the ZcashFoundation Zebra node prior to version 4.5.0. All users running Zebra 4.4.x or earlier are susceptible; version 4.5.0 and later include the fix.

The CVSS score of 9.3 indicates a high severity. No EPSS data is available, and the issue is not listed in the CISA KEV catalog. The attacker can simply craft and broadcast a P2SH transaction that contains a disabled opcode followed by signature operations; no block creation is required. Because Zebra will undercount sigops, such transactions can be included in blocks that Zebra will accept but which zcashd will reject, causing a consensus split between Zebra‑based nodes and the rest of the network.