Zebra 6.4.2 fixes a remote crash and withdraws the two releases before it
Victoria Shinder2 min readThe Zcash Foundation published Zebra 6.4.2 on 25 September as a security release and told operators not to run the two versions that preceded it. Release binaries and Docker images for Zebra 6.4.0 and 6.4.1 - both published on 23 September - have been withdrawn. The fix addresses a denial of service that can be triggered remotely by a malformed version-6 transaction, tracked as GHSA-h5rr-8pqv-grp9. The notes credit Google's OSS-Fuzz with the original report and two independent researchers with rediscovering it.
The withdrawn 6.4.0 was not a small release. It moved Zebra's end-of-support height forward to roughly 2 November, ahead of the NU7 network upgrade that is tentatively scheduled for 5 November, and asked operators to be on it before then. It also added an experimental gRPC server implementing the lightwalletd CompactTxStreamer interface, so a Zebra node can serve light wallets directly; new metrics for value-pool balances; per-/64 connection limits for IPv6 peers, closing a way for one machine to exceed max_connections_per_ip; and precomputed block templates for miners. Version 6.4.1, released hours later, fixed a syncer that could stall permanently after a restart near the chain tip.
The team was candid about the support-window change, writing that shortening it "is not ideal" and could leave some nodes unupgraded, and that it does not want the procedure to become common.
What it means
For anyone operating Zebra - exchanges, wallet backends, miners - the action is simple: move straight to 6.4.2 and do not pin 6.4.0 or 6.4.1 anywhere, including in container manifests that may still reference the withdrawn images. The fix is for an unauthenticated network input, which is the class of bug that matters most on a public peer-to-peer network.
The wider point is the calendar. Three Zebra releases in three days, one of them withdrawn for security and another for a sync regression, came just as the node set a hard deadline six weeks out. The next release is expected to carry NU7 support, and operators will have little room between it and the upgrade. The release notes' own advice - partner outreach to make sure nodes upgrade in time - is an admission that the margin is thin. Operators should schedule the NU7-capable release now, not when it lands.