CVE-2026-104423

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-104423
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-104423.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-104423
Aliases
  • GHSA-2p4c-3q4q-p463
Published
2026-10-02T11:38:05Z
Modified
2026-10-04T02:45:48Z
Severity
  • 8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
Zebra before 6.2.1 Denial of Service via Uncapped V6 Shielded Proof Verification
Details

Zebra (zebrad) before 6.2.1 contains an asymmetric resource consumption vulnerability that allows unauthenticated peers to stall block verification by pushing V6 mempool transactions with invalid Halo2 proofs. Attackers can flood the shared unprioritized Halo2 verification queue with zero-fee transactions carrying zero-filled Orchard and Ironwood proofs, causing nodes to fall behind the chain tip.

Database specific 
{
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-405"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/104xxx/CVE-2026-104423.json"
}
References

Affected packages

Git / github.com/zcashfoundation/zebra

Affected ranges

Type
GIT
Repo
https://github.com/zcashfoundation/zebra
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
f3edc40601b4a377693a32c982d4cddf1795fb6f
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "6.2.1"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "DESCRIPTION"
    ]
}

Affected versions

4.*
4.3.1
tower-batch-control-v1.*
tower-batch-control-v1.1.0
tower-batch-control-v1.1.1
tower-fallback-v0.*
tower-fallback-v0.2.42
tower-fallback-v0.2.43
v1.*
v1.0.0
v1.0.0-alpha.0
v1.0.0-alpha.1
v1.0.0-alpha.10
v1.0.0-alpha.11
v1.0.0-alpha.12
v1.0.0-alpha.13
v1.0.0-alpha.14
v1.0.0-alpha.15
v1.0.0-alpha.16
v1.0.0-alpha.17
v1.0.0-alpha.18
v1.0.0-alpha.19
v1.0.0-alpha.2
v1.0.0-alpha.3
v1.0.0-alpha.4
v1.0.0-alpha.5
v1.0.0-alpha.6
v1.0.0-alpha.7
v1.0.0-alpha.8
v1.0.0-alpha.9
v1.0.0-beta.0
v1.0.0-beta.1
v1.0.0-beta.10
v1.0.0-beta.11
v1.0.0-beta.12
v1.0.0-beta.13
v1.0.0-beta.14
v1.0.0-beta.15
v1.0.0-beta.2
v1.0.0-beta.3
v1.0.0-beta.4
v1.0.0-beta.5
v1.0.0-beta.6
v1.0.0-beta.7
v1.0.0-beta.8
v1.0.0-beta.9
v1.0.0-rc.0
v1.0.0-rc.1
v1.0.0-rc.2
v1.0.0-rc.3
v1.0.0-rc.4
v1.0.0-rc.5
v1.0.0-rc.6
v1.0.0-rc.7
v1.0.0-rc.8
v1.0.0-rc.9
v1.0.1
v1.1.0
v1.2.0
v1.3.0
v1.4.0
v1.5.0
v1.5.1
v1.5.2
v1.6.0
v1.6.1
v1.7.0
v1.8.0
v1.9.0
v2.*
v2.0.0
v2.0.0-rc.0
v2.0.1
v2.1.0
v2.2.0
v2.3.0
v2.4.0
v2.4.2
v2.5.0
v3.*
v3.0.0
v3.0.0-rc.0
v3.1.0
v4.*
v4.0.0
v4.1.0
v4.2.0
v4.3.0
v4.3.1
v4.4.0
v4.4.1
v4.5.0
v4.5.1
v5.*
v5.0.0
v5.1.0
v5.1.1
v5.2.0
v6.*
v6.0.0
v6.0.0-rc.0
v6.1.0
v6.2.0
zebra-chain-v11.*
zebra-chain-v11.1.0
zebra-chain-v11.2.0
zebra-consensus-v11.*
zebra-consensus-v11.0.0
zebra-consensus-v12.*
zebra-consensus-v12.0.0
zebra-consensus-v12.0.1
zebra-network-v10.*
zebra-network-v10.1.0
zebra-network-v10.1.1
zebra-network-v10.2.0
zebra-node-services-v9.*
zebra-node-services-v9.1.0
zebra-node-services-v9.1.1
zebra-rpc-v11.*
zebra-rpc-v11.1.0
zebra-rpc-v12.*
zebra-rpc-v12.0.0
zebra-script-v10.*
zebra-script-v10.1.0
zebra-script-v10.1.1
zebra-state-v10.*
zebra-state-v10.1.0
zebra-state-v11.*
zebra-state-v11.0.0
zebra-state-v11.1.0
zebra-utils-v9.*
zebra-utils-v9.1.0
zebra-utils-v9.1.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-104423.json"