CVE-2026-123554 Details

A denial-of-service vulnerability has been identified in Zebra Zebrad versions 6.4.0 prior to 7.0.0. The issue arises in the mempool coinbase-maturity check, where the function 'Transaction::coinbase_spend_restriction()' inefficiently rebuilds the transaction's output list for each spent outpoint. This flaw allows any connected peer to send unsigned transactions with numerous transparent inputs and outputs, which are rejected without penalizing the sender, effectively tying up the node's verification threads.

Upgrade to Zebra version 7.0.0, where this vulnerability has been fixed. The patch eliminates the quadratic workload by modifying the transaction data access methods to avoid unnecessary data cloning, and by restructuring the coinbase maturity checks to be more efficient.