Zcash Zebra EUVD-2026-91435

Exploitation requires the victim to run a Zebra node before 6.1.0 acting as a miner and using the getblocktemplate RPC to construct blocks via the ZIP-317 block template selector. The attacker must be able to inject valid, selectable transactions into that specific miner's mempool and shape them so the omitted header and transaction-count bytes push the template over the maximum block size. Limiting factors: only mining nodes building templates are affected (non-mining full nodes are not impacted), impact is confined to availability (wasted proof-of-work, no compromise), and the CVSS AC:H plus AT:P reflect the mempool-shaping and timing precision the attacker must achieve, making opportunistic mass exploitation impractical.

This is a genuine but low-urgency availability issue, not a high-severity priority. The CVSS 4.0 base score of 6.3 (MEDIUM) is driven by a network attack vector (AV:N) but tempered by high attack complexity (AC:H) and a present attack requirement (AT:P), with impact limited to availability of the vulnerable system (VA:L) and zero confidentiality or integrity impact (VC:N/VI:N). The real-world risk is modest: exploitation only wastes a victim miner's proof-of-work by causing oversized blocks to be rejected - there is no node compromise, fund theft, or data exposure. No EPSS score, KEV listing, or POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation; the finding was reported by VulnCheck and the vendor (Zcash Foundation) has published an advisory and patch. CONFLICT TO NOTE: the input Tags label this 'Information Disclosure,' which directly contradicts the CVSS vector (VC:N, no confidentiality impact) - this is an availability/resource-consumption flaw (CWE-131 incorrect buffer size calculation), not information disclosure, and the tag should be disregarded.

An attacker broadcasts specially crafted but individually valid transactions into the mempool of a Zcash miner running an unpatched Zebra node (before 6.1.0) that uses getblocktemplate. Because the ZIP-317 template selector omits header and transaction-count bytes from the block budget, these transactions get selected into a template that exceeds the maximum block size, so the mined block is rejected by the network and the miner's proof-of-work is wasted. No public exploit code was identified at time of analysis, and the high attack complexity plus timing/mempool-shaping requirement (AT:P) make reliable exploitation non-trivial.