The vulnerability allows a remote, unauthenticated P2P peer to stall a Zebra node by racing an invalid block body against the true canonical body for the same block header hash. ZIP‑244 permits the attacker to modify the coinbase scriptSig authentication data while leaving the transaction identifiers, merkle root, and header hash unchanged; the poisoned body later fails commitment validation yet shares the canonical hash. In Zebra, the hash is logged as a sent hash before contextual validation completes and is not removed when the write fails, so when the honest body arrives, the cached hash suppresses it. The result is the node being stuck one height behind until a restart or reorganization. This is a clear denial‑of‑service scenario, directly impacting node availability and network participation.

ZcashFoundation Zebra node, all releases prior to 4.5.0. The fix is included in v4.5.0 and later. Systems running these earlier versions are vulnerable.

The CVSS score of 8.7 categorises the problem as high severity. EPSS is not available, and the vulnerability is not listed in CISA’s KEV catalog, indicating it has not yet been observed in widespread exploitation. However, the attack requires only a malicious peer in the Zebra P2P network and no special privileges, making it relatively easy for an attacker operating within or controlling a network node to execute. The likely attack path is via the untrusted P2P layer, with the attacker sending a poisoned block body that befits the same header hash. Because the node will stall until restart, an attacker could use this to disrupt node operation, hindering network performance.