CVE-2026-104431: Zebra before 6.0.0 Denial of Service via Synchronous Script FFI Verification
Zebra before 6.0.0 contains a denial of service vulnerability that allows unauthenticated peers to stall Tokio workers by submitting mempool transactions requiring expensive synchronous script verification. Attackers can send non-standard high-sigop P2SH transactions that reach CachedFfiTransaction::isvalid() before standardness checks, saturating the verifier buffer and rendering the node unresponsive.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this denial of service?
Zcash Foundation Zebra versions before 6.0.0 are affected. A node is exposed if it accepts mempool transactions from unauthenticated network peers.
What does an attacker need to exploit the issue?
An attacker needs only network access to submit mempool transactions; no authentication, privileges, or user interaction are required. The attack uses non-standard high-sigop P2SH transactions that undergo expensive synchronous script verification before standardness checks.
What is the operational impact of a successful attack?
The submitted transactions can stall Tokio workers and saturate the verifier buffer. This can render the Zebra node unresponsive.