CVE-2026-104425: Zebra before 6.1.0 Batch-Verification Poisoning DoS via Unattributed Pushed Transactions
ZcashFoundation Zebra before 6.1.0 contains a resource exhaustion vulnerability that allows unauthenticated peers to degrade block processing by pushing transactions with invalid Orchard proofs without being misbehavior-scored. Attackers can repeatedly push invalid proofs into the shared halo2 batch verifier, forcing honest block proofs onto the slow individual-verification path and slowing block processing roughly sevenfold.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Zcash Foundation Zebra deployments running a version before 6.1.0 are affected. The attack is performed by network peers and does not require authentication.
What does an attacker need to do to trigger the slowdown?
An attacker needs to repeatedly push transactions containing invalid Orchard proofs. These proofs enter the shared halo2 batch verifier without the sender being misbehavior-scored, causing honest block proofs to fall back to slower individual verification.
What operational impact should operators expect?
The issue degrades block processing rather than compromising confidentiality or integrity. Processing can be slowed by roughly sevenfold while invalid proofs are used to poison the batch verifier.