Description
ZcashFoundation Zebra 6.4.0 before 6.4.2 parses version 6 transactions carrying a pre-NU6.3 consensus branch ID, but the size computation during UnminedTx construction treats re-serialization of the Orchard bundle as infallible, so the resulting error trips an expect that aborts zebrad. Unauthenticated peers can send a single pre-handshake tx message to crash the node, and can repeat this after each restart.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| ZcashFoundation | zebra | 6.4.0 – < 6.4.2 | 6.4.2 |
References
- GitHub Security Advisory (GHSA-h5rr-8pqv-grp9) vendor-advisory
- Patch Commit patch
- VulnCheck Advisory: Zebra 6.4.0 before 6.4.2 Denial of Service via Malformed v6 Transaction third-party-advisory