This vulnerability occurs in the Zebra node when identical shielded transactions are submitted in sequential parent and child blocks that are not finalized. The Chain::push function erroneously attempts to record the transaction hash and perform duplicate nullifier checks only after insertion, allowing the same transaction to bypass the uniqueness assertion. Consequently, the subsequent assertion fails, triggering a panic that aborts the process. The effect is a denial‑of‑service that terminates the entire zebrad process, preventing it from serving the network.

Hosts impacted are those running Zcash Foundation’s Zebra node or its zebra‑state component with any version prior to the 4.5.0 release. The issue was addressed in version 4.5.0, which implements proper transaction uniqueness checks before aborting. This vulnerability does not affect other Zcash clients such as Zcashd.

The CVSS score of 5.9 indicates moderate severity, and no EPSS value is available. The attack requires that the adversary is able to mine, or otherwise propagate, two consecutive blocks or a child block that contains the duplicate shielded transaction immediately following an honest block. Because the behavior is deterministic and a panic is executed, an attacker only needs to carefully construct the block sequence; no privileged influence of network nodes is required. The vulnerability is not currently listed in the CISA KEV catalog, but an unpatched node can be brought down in a targeted denial‑of‑service attack.