Description
Zebra from 2.3.0 before 7.0.0 contains a denial of service vulnerability that allows unauthenticated peers to evade misbehavior scoring by sending transactions or blocks with invalid transparent scripts. Attackers can flood mempool with script-failing transactions or serve forged v5 block bodies with altered scriptSig bytes to exhaust CPU and repeatedly stall block sync.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| ZcashFoundation | zebra | 2.3.0 – < 7.0.0, 1.0.0-beta.46 – < 18.0.0 | 7.0.0 |
References
- GitHub Security Advisory (GHSA-jq45-ghw5-v37x) vendor-advisory
- Patch Commit patch
- VulnCheck Advisory: Zebra 2.3.0 before 7.0.0 Denial of Service via Unscored Script Verification Failures third-party-advisory