The vulnerability in zebrad's getblocktemplate RPC handler arises from unsafe byte-index slicing of the LongPollId parameter, which can contain multi-byte UTF-8 characters. When slicing occurs at a byte offset that splits a multi-byte character, Rust's string indexing panics with a 'byte index is not a char boundary' error. Because zebrad is compiled with panic set to 'abort', this panic terminates the entire node process, resulting in a denial of service. Exploitation requires authentication to the RPC endpoint, typically via cookie authentication, but can be triggered by any client if authentication is disabled. The issue affects zebrad versions up to 4.4.1 and zebra-rpc versions prior to 8.0.0. The vulnerability is addressed by replacing byte-index slicing with character-aware parsing or validating that LongPollId contains only ASCII characters before slicing.

A single authenticated RPC request with a crafted LongPollId containing non-ASCII characters causes the zebrad process to abort, resulting in a full node denial of service. This impacts mining pools and infrastructure relying on zebrad's getblocktemplate RPC, as the node must be restarted to recover. The vulnerability does not affect confidentiality or integrity but causes availability disruption.

A patch is available in zebra-rpc 8.0.0 and zebrad 4.5.0 that fixes the unsafe string slicing. Until patched, users should disable the RPC server by removing rpc.listen_addr from zebrad.toml or ensure enable_cookie_auth is true and restrict access to the .cookie file to prevent unauthorized RPC access. Additionally, placing a reverse proxy in front of the RPC port to validate that LongPollId parameters contain only ASCII characters can mitigate exploitation.