Zcash Releases Emergency Zebra 4.4.0 Patch After Critical Consensus Bugs Found

[bonk]

Zcash has issued an urgent upgrade to Zebra 4.4.0 after the Zcash Foundation uncovered five security vulnerabilities, including three that could have broken network consensus.

The most serious flaw could allow an attacker to silently halt a node’s ability to discover new blocks using just a single malicious connection, with no alerts, bans, or detectable misbehavior—making it effectively invisible to standard monitoring tools. Other bugs included incorrect transaction validation logic and memory handling issues that could lead to chain splits or network instability.

Because multiple issues were consensus-critical, outdated nodes risk accepting invalid transactions that other implementations would reject, potentially fragmenting the blockchain.

The Foundation has strongly advised all operators to upgrade immediately, warning that older versions remain exposed to full exploitation risk.

[kevin1]

The broader April context of $651 million in losses across 30 exploits makes the timing of Zcash's disclosure strategically significant, releasing a critical patch during a period of heightened attacker activity compresses the window between public disclosure and exploitation attempts on unpatched nodes.