Uncontrolled Resource Consumption in Zebra by Zcash Foundation

CVE-2026-104436

What is CVE-2026-104436?

Zebra versions prior to 4.5.0 are susceptible to an uncontrolled resource consumption vulnerability that can be exploited by remote P2P peers. Attackers can send oversized block locator vectors within getblocks or getheaders messages, containing up to 65,535 locator hashes. This exploitation leads to excessive per-hash chain lookups, resulting in severe degradation of block validation, RPC, and mempool performance, thereby affecting the overall functionality and security of the network.

References