Uncontrolled Resource Consumption in Zebra by Zcash Foundation

CVE-2026-109365

What is CVE-2026-109365?

Zebra, developed by the Zcash Foundation, prior to version 6.4.0, is vulnerable to an uncontrolled resource consumption issue. This allows unauthenticated attackers to initiate full proof verification processes by presenting forged block bodies that appear to have valid header hashes. Exploiting this vulnerability can lead to inefficiencies in proof verification for the Sapling, Orchard, and Ironwood protocols, ultimately stalling synchronization of data for significant periods. Such vulnerabilities can be used to disrupt network operations without immediate consequences for the attackers.

References