An unauthenticated IPv4 peer can exploit a mismatch between canonicalized IPv4-mapped IPv6 addresses and raw transient addresses in Zebra’s mempool misbehavior handling. When a peer completes the P2P handshake and advertises an invalid transaction, the misbehavior batch flush triggers an assertion that aborts the zebrad process, effectively crashing the node. The vulnerability stems from improper address validation (CWE‑617) and type confusion (CWE‑843). This results in a loss of availability for the affected node, but it does not provide an attacker with direct control or data access.

The ZcashFoundation Zebra node is impacted. All releases older than version 4.5.0 are affected; any Zebra node running a 4.4.x or earlier release is vulnerable.

With a CVSS score of 7.5, the vulnerability is classified as high severity. The EPSS score is not available, and the issue is not listed in the CISA KEV catalog, indicating no known widespread exploitation yet. The attack vector is network-based and requires only an unauthenticated IPv4 connection using the default dual‑stack listener configuration. The attacker must successfully perform a handshake and send an invalid mempool transaction, after which the node will crash. Given the low effort required and the impact of a crash, the risk remains significant for publicly reachable nodes.