Zebra zebrad: Denial of service via unbounded V6 shielded proof verification
Summary
Zebra (zebrad) before 6.2.1 is a Zcash full node implementation. An unauthenticated peer can push V6 mempool transactions with invalid Halo2 proofs that are expensive to verify, which occupies the shared unprioritized verification queue and delays block verification. Under sustained attack, a node with few CPU cores falls behind the chain tip and recovers once the load stops; no crash, consensus fault or loss of funds is described.
Affected
- Zebra (zebrad) versions before 6.2.1 (vendor advisory lists up to and including 6.2.0)
- Affected when NU6.3 (Ironwood) is active on the network
- Default peer-to-peer networking is reachable by any peer
Fixed in
- Upgrade to Zebra 6.2.1 or later
- Vendor fix PRs (per third-party aggregator, not verified): #11053 and #11054
Workaround
- No vendor-documented workaround for unpatched nodes.
- Restricting peer and RPC exposure to the internet reduces reachability (own suggestion, not vendor-sourced).
Exploitation
- No exploitation in the wild found.
- CISA SSVC: Exploitation none, Automatable yes.
- EPSS about 0.34%.
- Public PoC unclear; the reporter states a private PoC exists.
Our recommendation
- Find out whether any zebrad instance runs in your environment and which version it uses.
- Upgrade to at least 6.2.1, preferably the latest stable release.
- Keep RPC and P2P ports off the public internet where not required.
- Monitor the NVD entry, which is currently deferred.
- Treat a Zebra node in wallet or payment services as high priority.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Vendor advisory GHSA-2p4c-3q4q-p463 github.com
- VulnCheck advisory www.vulncheck.com
- OSV entry CVE-2026-104423 osv.dev
- OpenCVE CVE-2026-104423 app.opencve.io
- Zebra security advisories github.com
- Zcash Foundation feed zfnd.org
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 06:03.
Original description (NVD)
Zebra (zebrad) before 6.2.1 contains an asymmetric resource consumption vulnerability that allows unauthenticated peers to stall block verification by pushing V6 mempool transactions with invalid Halo2 proofs. Attackers can flood the shared unprioritized Halo2 verification queue with zero-fee transactions carrying zero-filled Orchard and Ironwood proofs, causing nodes to fall behind the chain tip.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.