An assertion failure vulnerability in the Zcash Foundation ZEBRA node allows unauthenticated attackers to cause a node crash via specially crafted Orchard transactions.

This is a Reachable Assertion vulnerability, categorized under CWE-617, where the orchard crate panics when processing an Orchard transaction containing an identity value in the randomized validating key field. The attack vector is network-based and requires no authentication or user interaction.

A successful exploit results in a denial of service by crashing the target Zcash node, leading to potential network downtime and operational disruption for node operators. The CVSS score of 7.5 reflects the high severity of availability loss, allowing remote attackers to disrupt blockchain node operations without authentication.

Immediate Action: Update crates.io/zebrad to version 4.3.1 and crates.io/zebra-chain to version 6.0.2 immediately.

Proactive Monitoring: Monitor node logs for unexpected panic events, assertion failures, or sudden restarts associated with transaction processing.

Compensating Controls: Implement network-level filtering and rate limiting at the perimeter to detect and block malformed or anomalous peer traffic before it reaches the node software.

Public Exploit Available: No - As of May 10, 2026, there is no confirmed public exploit in the available data.

This high-severity vulnerability poses an immediate availability risk to all unpatched Zcash ZEBRA nodes. Administrators must apply the vendor security updates to zebrad version 4.3.1 and zebra-chain version 6.0.2 immediately to prevent potential denial of service attacks.