# Release: Zakura 1.0.1

Announcement dated 2026-07-17: Zakura 1.0.1, a security release. Zakura is
a Zcash full node.

What the announcement says:

- Zakura 1.0.1 fixes three security issues that the Zakura team discovered
  in upstream Zebra and that affect Zakura 1.0.0. All node operators should
  update immediately.
- All three issues are denial-of-service vectors (degraded or stalled block
  validation or mining). The teams consider these kinds of issues high
  severity for miners, but none of them can lead to loss of user funds,
  crashes, state corruption, or consensus divergence. They are tracked as
  Zebra advisories
  GHSA-4g24-549m-hp75 (quadratic block processing time),
  GHSA-g7c4-2w6c-cr3r (remote validation poisoning), and
  GHSA-95m2-vx53-v2jw (oversized block templates).
- The issues were found in Zebra before Zakura 1.0.0 shipped; the team
  released 1.0.0 as planned and began coordinated disclosure with the Zcash
  Foundation immediately afterward. Zebra fixes these issues in version
  6.1.0. Shielded Labs was also privately notified at the same time but,
  due to time constraints and differing priorities, is not part of this
  coordinated software release.
- Zakura 1.0.0 shipped with an end-of-support (EOS) halt one week after its
  release in anticipation of this fix; 1.0.0 nodes will warn and then halt.
  Zakura 1.0.1 reaches end of support roughly one week after Ironwood
  (NU6.3) activation.
- The release also contains performance and stability improvements: initial
  sync now runs in bounded memory (the block backlog is kept in serialized
  form, making the 1.5 GiB default look-ahead budget a real memory bound,
  with sync memory use exported as metrics); several initial-sync stall
  conditions are fixed (timed-out header ranges are retried indefinitely,
  checkpoint-boundary bookkeeping no longer strands verification capacity,
  Sapling-empty heights are no longer mistaken for coverage gaps, and
  pruned nodes no longer invent metadata for blocks they don't store); and
  validation is stricter with untrusted bytes (block bodies are checked
  against the authorizing-data root, since ZIP-244 hashes don't commit to
  authorizing data; oversized FindBlocks responses are rejected early; and
  invalidating a block removes every fork built on it).
- Updating: signed release binaries or the `zakura` crate 1.0.1 via Cargo;
  installation and verification instructions are on the download page
  (https://zakura.com/download/).

---

Canonical HTML version: https://zakura.com/announcements/zakura-1-0-1/