CVE-2026-104424

Low

Description

Zebra before 6.1.0 contains an incorrect calculation vulnerability in its ZIP-317 block template selector that omits header and transaction-count size from the block budget. Attackers can place valid selectable transactions in a victim miner's mempool to shape templates into oversized blocks, causing rejection and wasted proof-of-work.

SeverityLow

CVSS3.7

Exploit probability—

ProductZcashfoundation Zebra

PublishedOct 2, 2026

First seenOct 2, 2026

Weakness typeCWE-131CWE-131

How to fix

Update

ZcashFoundation zebra6.1.0 or later

Vendor advisories

github.com/ZcashFoundation/zebra/security/advisories/GHSA-95m2-vx53-v2jw

Affected products

Product	Affected versions	Fixed in
ZcashFoundation zebra	v < 6.1.0	6.1.0

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.