CVE-2026-104423

Zebra before 6.2.1 Denial of Service via Uncapped V6 Shielded Proof Verification

Published Oct 2, 2026 CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Description

Zebra (zebrad) before 6.2.1 contains an asymmetric resource consumption vulnerability that allows unauthenticated peers to stall block verification by pushing V6 mempool transactions with invalid Halo2 proofs. Attackers can flood the shared unprioritized Halo2 verification queue with zero-fee transactions carrying zero-filled Orchard and Ironwood proofs, causing nodes to fall behind the chain tip.

Analysis

Technical impact

Zebra (zebrad) before version 6.2.1 exposes an asymmetric resource consumption flaw (CWE-405) that lets any unauthenticated peer stall block verification by submitting V6 mempool transactions with invalid Halo2 proofs. Attackers can flood the shared, unprioritized Halo2 verification queue with zero‑fee transactions that contain zero‑filled Orchard and Ironwood proofs. The overload forces full‑node software to lag behind the latest block, effectively denying availability of the node, and there is no indication of data integrity or confidentiality impact.

Affected Systems

All ZcashFoundation Zebra nodes running the zebrad daemon with a release older than 6.2.1 are affected. Deployments of zebra before 6.2.1 that expose the default RPC or P2P ports to the internet are vulnerable to the described attack. Based on the description it is inferred that exposing these ports increases exposure.

Risk and Exploitability

The CVSS score of 8.7 classifies the flaw as high severity. With no privilege required and no special conditions, an attacker can send crafted transactions from any remote address, making the exploitation probability high. EPSS is not available, and the description does not detail mitigation measures in earlier releases, so risk remains elevated. The vulnerability is not listed in the CISA KEV catalog; there is no data on the prevalence of public nodes, so potential operational impact is uncertain.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

ZcashFoundation

zebra

unaffected

Version	Status	Constraints
`0`	affected	< 6.2.1
`6.2.1`	unaffected	—

No data.

Vendor Product Versions

Zcashfoundation

Zebra

Version	Status	Scheme	Platform
`[0,6.2.1)`	affected	semver	—
`6.2.1`	unaffected	semver	—

Zfnd

Zebra

Version	Status	Scheme	Platform
`[0,6.2.1)`	affected	semver	—
`6.2.1`	unaffected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade Zebra to version 6.2.1 or later to apply the official patch.
If an upgrade cannot be performed immediately, limit the zebrad network access to trusted peers only; configure a firewall or VPN to block unauthenticated connections to the P2P ports.
Continuously monitor block height and verification latency; if a node falls behind the chain tip, investigate for malicious traffic and consider temporarily shutting down or removing untrusted peers.

Generated by OpenCVE AI on October 2, 2026 at 13:57 UTC.

Tracking

Advisories

No advisories available

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.343% probability within 30 days)

Exploitation none

Automatable yes

Technical Impact partial

References

Link	Providers
https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-2p4c-3q4q-p463
https://www.vulncheck.com/advisories/zebra-before-6.2.1-denial-of-service-via-uncapped-v6-shielded-proof-verification

History

Oct 2, 2026 4:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Oct 2, 2026 3:30 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Zcashfoundation Zcashfoundation zebra
Vendors & Products		Zcashfoundation Zcashfoundation zebra

Oct 2, 2026 11:45 AM Description updated. Title updated. First appearance in the feed. Weaknesses updated. Affected versions updated. Affected vendors updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Zebra (zebrad) before 6.2.1 contains an asymmetric resource consumption vulnerability that allows unauthenticated peers to stall block verification by pushing V6 mempool transactions with invalid Halo2 proofs. Attackers can flood the shared unprioritized Halo2 verification queue with zero-fee transactions carrying zero-filled Orchard and Ironwood proofs, causing nodes to fall behind the chain tip.
Title		Zebra before 6.2.1 Denial of Service via Uncapped V6 Shielded Proof Verification
First Time appeared		Zfnd Zfnd zebra
Weaknesses		CWE-405
CPEs		cpe:2.3:a:zfnd:zebra::::::::
Vendors & Products		Zfnd Zfnd zebra
References		https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-2p4c-3q4q-p463 https://www.vulncheck.com/advisories/zebra-before-6.2.1-denial-of-service-via-uncapped-v6-shielded-proof-verification
Metrics		cvssV3_1 `{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}` cvssV4_0 `{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}`