Zcash Zebra: Denial of service via unauthenticated mempool transactions
Summary
Zebra, a Rust implementation of a Zcash full node, runs expensive script verification on transactions offered by peers before cheap mempool standardness checks reject non-standard high-sigop P2SH transactions. An unauthenticated remote peer can send such transactions to saturate the verifier and stall Tokio workers, degrading mempool, block and network processing. The default configuration is affected. The impact is availability only, lasting while the load persists; no code execution, consensus fault or loss of funds is reported.
Affected
- Zebra versions before 6.0.0
- CNA range: 0 to below 6.0.0 (VulnCheck)
- GHSA-84j3-rw4c-gqmj lists versions up to and including 5.2.0 as affected
Fixed in
- Zebra 6.0.0 (released 10 July 2026, also the NU6.3 network upgrade release)
Workaround
- No configuration-only workaround is documented that removes the mechanism.
- Restricting inbound peer connections reduces exposure.
- Upgrading to 6.0.0 is the durable fix.
Exploitation
- No known exploitation in the wild; CISA SSVC lists exploitation as none, automatable as yes.
- No public proof of concept found in the reviewed sources.
Our recommendation
- Inventory all Zcash/Zebra nodes and confirm their versions.
- Upgrade affected nodes to 6.0.0 or later; this is also needed for network compatibility.
- Restrict exposure of public nodes where possible and monitor node responsiveness and mempool load.
- Priority is low for most SMEs unless they operate a Zcash node, for example in a wallet, exchange or payment backend.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-84j3-rw4c-gqmj github.com
- VulnCheck advisory www.vulncheck.com
- Zebra 6.0.0 release github.com
- Zcash Foundation 6.0.0 release notes zfnd.org
- OSV entry CVE-2026-104431 osv.dev
- Vulners CVE record vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 06:02.
Original description (NVD)
Zebra before 6.0.0 contains a denial of service vulnerability that allows unauthenticated peers to stall Tokio workers by submitting mempool transactions requiring expensive synchronous script verification. Attackers can send non-standard high-sigop P2SH transactions that reach CachedFfiTransaction::is_valid() before standardness checks, saturating the verifier buffer and rendering the node unresponsive.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.