Zcash Foundation releases Zebra 4.5.0 emergency security update to fix multiple consensus-level vulnerabilities

ChainCatcher news, the Zcash Foundation has released the Zebra node client version 4.5.0 update. This version includes multiple security fixes, including a critical consensus vulnerability and several high-risk denial-of-service (DoS) issues. All node operators are strongly advised to upgrade immediately.

The key fixes in this update include a sigop counting error caused by P2SH script parsing (which could lead to a consensus fork with zcashd), defects in the block verification cache logic for NU5, a crash risk caused by transparent address balance overflow, as well as several vulnerabilities leading to crashes and resource exhaustion in RPC interfaces and mempool handling. In addition, some vulnerabilities could be exploited by malicious nodes to cause node freezes, restart loops, or even permanent shutdowns.