CVE-2026-104423CWE-405

CVE-2026-104423

High · published October 2, 2026

CVSS v3.1
7.5
EPSS
0%
Percentile
26.6
In the wild
Unconfirmed
What it is

Zebra (zebrad) before 6.2.1 contains an asymmetric resource consumption vulnerability that allows unauthenticated peers to stall block verification by pushing V6 mempool transactions with invalid Halo2 proofs. Attackers can flood the shared unprioritized Halo2 verification queue with zero-fee transactions carrying zero-filled Orchard and Ironwood proofs, causing nodes to fall behind the chain tip.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
8.7 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
EPSS
0.00343 · 26.6th percentile
Weakness
CWE-405 · Asymmetric Resource Consumption (Amplification)
Published
2026-10-02T16:17Z
References (2)
https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-2p4c-3q4q-p463 · [email protected]https://www.vulncheck.com/advisories/zebra-before-6.2.1-denial-of-service-via-uncapped-v6-shielded-proof-verification · [email protected]
EPSS history
Timeline
  • 04 OCT 03:27Z
    EPSS moved — → 0%
    epss
  • 02 OCT 11:38Z
    Zebra before 6.2.1 Denial of Service via Uncapped V6 Shielded Proof Verification
    cvelistv5