CVE-2026-104423
High
Description
Zebra (zebrad) before 6.2.1 contains an asymmetric resource consumption vulnerability that allows unauthenticated peers to stall block verification by pushing V6 mempool transactions with invalid Halo2 proofs. Attackers can flood the shared unprioritized Halo2 verification queue with zero-fee transactions carrying zero-filled Orchard and Ironwood proofs, causing nodes to fall behind the chain tip.
SeverityHigh
CVSS7.5
Exploit probability—
ProductZcashfoundation Zebra
PublishedOct 2, 2026
First seenOct 2, 2026
Weakness typeCWE-405CWE-405
How to fix
Update
- ZcashFoundation zebra6.2.1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| ZcashFoundation zebra | v < 6.2.1 | 6.2.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.