Technical impact
Zebra contains an inefficient algorithmic complexity flaw in the remaining_transaction_value component that clones the entire block‑level spent‑UTXO map for each transaction during contextual verification, resulting in quadratic behavior that can be triggered by submitting a block with many minimal single‑input transactions. The advisory indicates that an attacker can mine or seed the mempool with roughly 26,000 minimal transactions in one block, stalling every validating node for over 52 seconds.
Affected Systems
The Zebra blockchain node software from the Zcash Foundation, in all releases before version 6.1.0, is affected.
Risk and Exploitability
The high CVSS score of 8.2 and the lack of an EPSS score indicate a serious risk; the issue is exposed during block validation, meaning that any Zebra validator that accepts arbitrary blocks is susceptible. Attackers can engineer a block containing roughly 26,000 minimal single‑input transactions to trigger the quadratic algorithmic cost, overwhelming a node’s CPU for approximately 52 seconds per block. Since the vulnerability is not listed in the CISA KEV catalog, it is not currently known to be actively exploited in the wild, but the feasibility of constructing such blocks gives attackers a viable DoS vector.
