CVE-2026-123559 Details
Description
Zebra before 7.0.0 contains an inefficient algorithmic complexity vulnerability that allows unauthenticated peers to exhaust verification threads by submitting transactions with many transparent inputs. Attackers can relay invalid transactions with tens of thousands of inputs, forcing quadratic ZIP-244 or ZIP-243 digest recomputation that stalls Rayon-backed block verification for minutes.
A denial-of-service vulnerability has been identified in Zebra versions prior to 7.0.0. This vulnerability arises from an inefficient algorithmic complexity that allows unauthenticated peers to exhaust verification threads. Attackers can relay invalid transactions containing tens of thousands of transparent inputs, which forces a quadratic recomputation of ZIP-244 or ZIP-243 digests. This process stalls Rayon-backed block verification for several minutes.
Upgrade to Zebra version 7.0.0 or later. The patched version in 7.0.0 includes improvements that address the quadratic complexity issue by optimizing how transparent signature hashes are computed and verified. After upgrading, ensure that the node is not exposed to untrusted peers or RPC callers.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Nov 8, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-407 | Inefficient Algorithmic Complexity | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| ZcashFoundation Zebra | < 7.0.0 (semver) |
CPE
Remediation
| |
Change History
1 change record found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 8, 2026 | New CVE Received | [email protected] |