CVE-2026-104431GHSA-84j3-rw4c-gqmj
Zebra before 6.0.0 Denial of Service via Synchronous Script FFI Verification
ZcashFoundation zebra
CVSS
8.7HighExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.34%Chance of exploitation activity in the next 30 days, higher than 26% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 6.0.0zebraCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
Zebra before 6.0.0 contains a denial of service vulnerability that allows unauthenticated peers to stall Tokio workers by submitting mempool transactions requiring expensive synchronous script verification. Attackers can send non-standard high-sigop P2SH transactions that reach CachedFfiTransaction::is_valid() before standardness checks, saturating the verifier buffer and rendering the node unresponsive.
Text from CVE List
Affected versions 2
- zebraaffected: all versions before 6.0.0CVE List
- zebraunaffected: 6.0.0CVE List