The z_listunifiedreceivers RPC handler in zebrad versions up to and including v4.4.1 improperly handles structurally valid but cryptographically invalid Sapling receivers embedded in Unified Addresses. Specifically, the handler calls a function that returns None for invalid Jubjub subgroup points but uses .expect() on this result, causing a panic and process abort when invalid data is encountered. Because zebrad is compiled with panic = "abort", this terminates the entire node process, not just the RPC task. The vulnerability requires RPC authentication, which by default requires local access to the .cookie file, but can be exposed remotely if cookie authentication is disabled. The issue is fixed in zebra-rpc 8.0.0 and zebrad 4.5.0 by replacing the panic with proper error propagation.

An authenticated attacker can send a single crafted RPC request to the z_listunifiedreceivers handler that causes the zebrad node process to abort immediately, resulting in a denial of service. The attack can be repeated indefinitely, preventing the node from operating until the malicious requests are blocked or the RPC server is disabled. This impacts node availability but does not affect confidentiality or integrity.

A fix is available in zebrad 4.5.0 and zebra-rpc 8.0.0 that properly handles invalid Sapling receiver data without panicking. Until patched, operators should disable the RPC server by removing rpc.listen_addr from zebrad.toml, ensure enable_cookie_auth is true and restrict access to the .cookie file, or place a reverse proxy in front of the RPC port to filter out malicious z_listunifiedreceivers calls. These mitigations prevent unauthenticated or unauthorized triggering of the vulnerability.