Description
Zebra before 6.1.0 contains an incorrect calculation vulnerability in its ZIP-317 block template selector that omits header and transaction-count size from the block budget. Attackers can place valid selectable transactions in a victim miner's mempool to shape templates into oversized blocks, causing rejection and wasted proof-of-work.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| ZcashFoundation | zebra | < 6.1.0 | 6.1.0 |
References
- GitHub Security Advisory (GHSA-95m2-vx53-v2jw) vendor-advisory
- VulnCheck Advisory: Zebra before 6.1.0 Incorrect Block Size Calculation in getblocktemplate third-party-advisory