CVE-2026-104436: Zebra before 4.5.0 CPU Amplification via Uncapped getblocks/getheaders Locator Length
Zebra before 4.5.0 contains an uncontrolled resource consumption vulnerability that allows remote P2P peers to exhaust blocking-pool threads by sending oversized block locator vectors. Attackers can send getblocks or getheaders messages with up to 65,535 locator hashes, triggering per-hash chain lookups that degrade block validation, RPC, and mempool performance.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Zcash Foundation Zebra deployments running a version before 4.5.0 are affected if they accept P2P peers that can send getblocks or getheaders messages.
What does an attacker need to do to trigger the resource exhaustion?
An attacker only needs remote P2P connectivity; no privileges or user interaction are required. They send getblocks or getheaders requests containing oversized block locator vectors, up to 65,535 locator hashes, causing per-hash chain lookups.
What operational impact should be expected during exploitation?
Oversized requests can exhaust blocking-pool threads and degrade block validation, RPC, and mempool performance. The supplied severity vector indicates availability impact only, with no stated confidentiality or integrity impact.