CVE-2026-104423

Zebra before 6.2.1 Denial of Service via Uncapped V6 Shielded Proof Verification

State: Published
Severity: 8.7 High
Published: Oct 2, 2026
Updated: Oct 2, 2026
Reserved: Oct 2, 2026

Description

Zebra (zebrad) before 6.2.1 contains an asymmetric resource consumption vulnerability that allows unauthenticated peers to stall block verification by pushing V6 mempool transactions with invalid Halo2 proofs. Attackers can flood the shared unprioritized Halo2 verification queue with zero-fee transactions carrying zero-filled Orchard and Ironwood proofs, causing nodes to fall behind the chain tip.

Scores

CVSS	Score	Vector	Source
4.0	8.7 High	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N	VulnCheck
3.1	7.5 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	VulnCheck

Weaknesses

CWE-405 Asymmetric Resource Consumption (Amplification)

Affected Products

Product	Versions
zebraZcashFoundation	before 6.2.1Affected 6.2.1Not affected

References

GitHub Security Advisory (GHSA-2p4c-3q4q-p463)vendor-advisory
VulnCheck Advisory: Zebra before 6.2.1 Denial of Service via Uncapped V6 Shielded Proof Verificationthird-party-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.