Compliance Impact

The provided information does not specify any impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0

Executive Summary

This vulnerability exists in the ZEBRA Zcash node software, specifically in versions prior to zebrad 4.4.0, zebra-chain 7.0.0, and zebra-network 6.0.0. Several inbound deserialization paths allocate buffers based on generic transport or block-size ceilings before enforcing tighter protocol or consensus limits.

As a result, an unauthenticated or post-handshake peer can force the node to preallocate and parse significantly more data than intended by the protocol. This affects headers messages, equihash solutions in block headers, Sapling spend vectors in V5/V4 transactions, and coinbase script bytes in blocks.

This issue has been fixed in the specified newer versions of the software.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can lead to resource exhaustion on the affected node by forcing it to allocate and process much larger amounts of data than intended. This can degrade performance or potentially cause denial of service conditions.

Since the attack can be performed by an unauthenticated or post-handshake peer, it increases the risk of exploitation from external sources without requiring privileged access.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, upgrade your Zebra components to the patched versions: zebrad to version 4.4.0 or later, zebra-chain to version 7.0.0 or later, and zebra-network to version 6.0.0 or later.

These updates fix the issue where inbound deserialization paths allocated excessively large buffers, preventing potential denial of service caused by allocation amplification.

Useful 0 Not Useful 0