Asymmetric Resource Consumption Issue in Zebra by Zcash Foundation
CVE-2026-104423

8.7HIGH

Key Information:

Vendor

Zcashfoundation

Status
Zebra
Vendor
CVE Published:
2 October 2026

What is CVE-2026-104423?

Zebra versions before 6.2.1 are at risk due to an asymmetric resource consumption vulnerability. This flaw enables unauthenticated users to obstruct block verification processes by overwhelming the Halo2 verification queue with invalid V6 mempool transactions. Attackers may exploit this by submitting zero-fee transactions containing unusable proofs, which can cause nodes to lag behind the current blockchain state, potentially disrupting service and impacting overall network stability.

Affected Version(s)

zebra 0 < 6.2.1

zebra 6.2.1

References

https://github.com/ZcashFoundation/zebra/security/advisor...
vendor-advisory
https://www.vulncheck.com/advisories/zebra-before-6.2.1-d...
third-party-advisory

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

craftsoldier
conradoplg
upbqdn
.