GHSA-7jp4-mq53-4cvq: Zebra zebrad 6.4.0 before 7.0.0 Denial of Service via Mempool Coinbase-Maturity Check

Published Nov 8, 2026

Updated

Zebra zebrad 6.4.0 before 7.0.0 performs quadratic work in the mempool coinbase-maturity check because Transaction::coinbasespendrestriction() rebuilds the transaction's output list once per spent outpoint. Any connected peer can repeatedly send unsigned transactions with many transparent inputs and outputs, which are rejected without a misbehavior score, to pin verification threads.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Zebra zebrad to a version that resolves this vulnerability.
Fixed in 7.0.0

Event History

Nov 8, 2026

CVE Published

via OSV·01:37 AM

Data Sourced

via OSV·01:37 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed to this denial-of-service condition?

Zebra zebrad versions from 6.4.0 up to, but not including, 7.0.0 are affected. A node is exposed when it accepts connections from peers that can submit transactions to its mempool.

What does an attacker need to do to exploit it?

Any connected peer can repeatedly send unsigned transactions containing many transparent inputs and outputs. The transactions are rejected, but processing their coinbase-maturity checks can consume quadratic work and pin verification threads.

Does the attacker need to behave maliciously enough to be penalized or disconnected?

No. The described transactions are rejected without receiving a misbehavior score, allowing a connected peer to repeat the requests without that stated penalty.

GHSA-7jp4-mq53-4cvq: Zebra zebrad 6.4.0 before 7.0.0 Denial of Service via Mempool Coinbase-Maturity Check

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed to this denial-of-service condition?

What does an attacker need to do to exploit it?

Does the attacker need to behave maliciously enough to be penalized or disconnected?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this denial-of-service condition?

What does an attacker need to do to exploit it?

Does the attacker need to behave maliciously enough to be penalized or disconnected?