Zebra, a Zcash node implementation written in Rust, contained a composite denial-of-service vulnerability (CWE-770) in its block discovery pipeline before version 4.4.0. An unauthenticated remote attacker could exploit three independent weaknesses in the gossip, syncer, and download subsystems through a single TCP connection. This exploitation causes a monotonically growing block deficit that does not self-heal, effectively halting all new block discovery on the targeted node. The vulnerability has been addressed and fixed in Zebra version 4.4.0.

The vulnerability allows an unauthenticated remote attacker to cause a permanent denial-of-service condition by stopping all new block discovery on a Zebra node. This disrupts the node's ability to participate in the blockchain network effectively, potentially impacting network reliability and node availability. There are no known exploits in the wild at this time.

This vulnerability has been patched in Zebra version 4.4.0. Users should upgrade to version 4.4.0 or later to remediate this issue. No other mitigation actions are indicated by the vendor advisory.