An unauthenticated P2P peer can answer Zebra’s outbound getblocks or FindBlocks request with a minimal inventory and then serve a syntactically valid block whose coinbase height far exceeds the node’s current chain tip. The resulting verification error fails to determine the offending peer and propagates to the sync logic, causing a full sync restart and a 67‑second delay on mainnet. The attack does not corrupt the chain state but repeatedly forces the node to restart its synchronization process, degrading availability for other peers. The vulnerability is triggered by any remote node that is reachable over the network; no prior authentication or elevated privileges are required. Because the offending peer is neither punished nor disconnected, an attacker can repeat the cycle indefinitely with minimal bandwidth, resulting in prolonged degradation of synchronization for honest peers. The impact is a non‑destructive but persistent denial‑of‑service condition that hampers timely block propagation and may affect higher‑level services that rely on a fully synchronized node.

The affected vendor is Zcash Foundation, specifically its Zebra node and Zebra‑consensus implementations. All releases prior to version 4.5.0 are vulnerable. The issue was addressed in Zebra 4.5.0 and later releases.

The CVSS score of 5.3 indicates moderate severity, and no EPSS or KEV data is currently available. Attackers can exploit this remotely and unauthenticated via the network, requiring only minimal bandwidth to repeatedly trigger sync restarts. The capacity to repeat the attack indefinitely makes the risk significant even though the attack does not compromise state integrity.