All vulnerabilities
CVE-2026-104436GHSA-443g-gwgp-49x4

Zebra before 4.5.0 CPU Amplification via Uncapped getblocks/getheaders Locator Length

ZcashFoundation zebracrates.ioLibraries & packages
Open in ThreatlineRecord JSON
CVSS
6.3Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.27%Chance of exploitation activity in the next 30 days, higher than 18% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in4.5.0Also 8.0.0CVE List
Published2 Oct 2026Updated 3 Oct 2026CVE List

What fixes it

  • 4.5.0zebraCVE List
  • 8.0.0zebraCVE List
  • 4.5.0zebrad, crates.ioOSVcargo update -p zebrad --precise 4.5.0
  • 8.0.0zebra-chain, crates.ioOSVcargo update -p zebra-chain --precise 8.0.0

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Zebra before 4.5.0 contains an uncontrolled resource consumption vulnerability that allows remote P2P peers to exhaust blocking-pool threads by sending oversized block locator vectors. Attackers can send getblocks or getheaders messages with up to 65,535 locator hashes, triggering per-hash chain lookups that degrade block validation, RPC, and mempool performance.

Text from CVE List

Affected versions 6

  • zebraaffected: all versions before 4.5.0CVE List
  • zebraunaffected: 4.5.0CVE List
  • zebraaffected: all versions before 8.0.0CVE List
  • zebraunaffected: 8.0.0CVE List
  • zebrad, crates.iofrom first release, fixed in 4.5.0OSV
  • zebra-chain, crates.iofrom first release, fixed in 8.0.0OSV

References 2