[ CVE-2026-104426 · Published 2 Oct 2026 ]
Vulnerability in ZcashFoundation zebra
CVSS 5.9
EPSS <1%No fix listed yet
[ Description ]Official description
Zebra before 6.1.0 contains an inefficient algorithmic complexity vulnerability in remaining_transaction_value that clones the entire block-level spent-UTXO map per transaction during contextual verification. Attackers can mine or seed the mempool with roughly 26,000 minimal single-input transactions in one block, stalling every validating node for over 52 seconds.
[ Fixes ]Fixes and patches
No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.