Resource Exhaustion Vulnerability in Zebra by Zcash Foundation
CVE-2026-104425

6.9MEDIUM

Key Information:

Vendor

Zcashfoundation

Status
Zebra
Vendor
CVE Published:
2 October 2026

What is CVE-2026-104425?

The Zebra application from Zcash Foundation is impacted by a resource exhaustion vulnerability. This flaw allows unauthenticated peers to overwhelm the block processing functionality by submitting transactions with invalid Orchard proofs. As a result, these invalid submissions can divert valid block proofs into a slower verification process, significantly hindering the transaction throughput and overall network efficiency. The issues stem from the shared halo2 batch verifier, which can be exploited to push numerous invalid proofs without repercussions.

Affected Version(s)

zebra 0 < 6.1.0

zebra 6.1.0

References

https://github.com/ZcashFoundation/zebra/security/advisor...
vendor-advisory
https://www.vulncheck.com/advisories/zebra-before-6.1.0-b...
third-party-advisory

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

ValarDragon
ebfull
upbqdn
.