CVE-2026-104424: Zebra before 6.1.0 Incorrect Block Size Calculation in getblocktemplate
Zebra before 6.1.0 contains an incorrect calculation vulnerability in its ZIP-317 block template selector that omits header and transaction-count size from the block budget. Attackers can place valid selectable transactions in a victim miner's mempool to shape templates into oversized blocks, causing rejection and wasted proof-of-work.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Zcash Foundation Zebra versions before 6.1.0 are affected where the ZIP-317 block template selector is used to produce block templates.
What does an attacker need to do to trigger the problem?
An attacker needs to place valid, selectable transactions into a victim miner's mempool so they influence the generated block template. Exploitation does not require privileges or user interaction, but the attack complexity is rated high.
What is the operational impact on a miner?
The faulty budget calculation can create oversized block templates because header and transaction-count size are omitted. Resulting blocks can be rejected, wasting the proof-of-work performed by the miner.
What version resolves the issue?
Upgrade Zebra to version 6.1.0 or later.