Improper Check for Unusual or Exceptional Conditions in Zcash - #VU137467
Published: July 14, 2026
Vulnerability identifier: #VU137467
CSH Severity: Medium
CVSS v4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-754
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to improper handling of body-derived validation failures in CheckBlock()/AcceptBlock() and shared CBlockIndex state when processing a malformed NU5+ block body for a genuine header near MAX_BLOCK_SIZE. A remote attacker can submit a specially crafted malformed block body to cause a denial of service.
The issue affects nodes that ingest the malformed body before the genuine body for the same header, causing the genuine block at that height to be rejected until restart.
Affected software
Zcash
Remediation
Install security update from vendor's website.
Zcash - update to 6.20.0