Inefficient Algorithmic Complexity Vulnerability in Zebra by Zcash Foundation
CVE-2026-104426

8.2HIGH

Key Information:

Vendor

Zcashfoundation

Status
Zebra
Vendor
CVE Published:
2 October 2026

What is CVE-2026-104426?

Zebra versions before 6.1.0 are affected by an inefficient algorithmic complexity issue in the remaining_transaction_value function. This vulnerability allows attackers to exploit the system during contextual verification by cloning the entire block-level spent-UTXO map for each transaction. A malicious actor can create approximately 26,000 minimal single-input transactions within one block, causing significant delays—stagnating validating nodes for over 52 seconds. This can lead to denial of service, affecting the overall performance and reliability of the blockchain.

Affected Version(s)

zebra 0 < 6.1.0

zebra 6.1.0

References

https://github.com/ZcashFoundation/zebra/security/advisor...
vendor-advisory
https://www.vulncheck.com/advisories/zebra-before-6.1.0-q...
third-party-advisory

CVSS V4

Score:
8.2
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

ValarDragon
oxarbitrage
.