Zebra EUVD-2026-28801

Zebra is a Rust-based alternative full node implementation for the Zcash cryptocurrency network, performing block validation and network consensus functions. The vulnerability stems from CWE-770 (Allocation of Resources Without Limits or Throttling) affecting three distinct subsystems in the block discovery pipeline: the peer-to-peer gossip protocol handler, the blockchain state synchronization component, and the block download manager. The composite nature means an attacker can exploit resource allocation flaws across multiple code paths simultaneously from a single connection, creating compounding effects. Unlike traditional resource exhaustion attacks that flood capacity, this creates a logical state corruption where the node's internal block height tracking diverges from network consensus in a monotonically increasing manner (the 'block deficit' grows indefinitely). Because Zebra is written in Rust and handles cryptocurrency transaction validation, the affected component likely involves unsafe interaction between asynchronous download queues and synchronous state machine updates, allowing queue depth or state counters to grow unbounded when receiving malformed or strategically timed peer messages.