CVE-2026-123554 · Runtime
NO FIX YET · SEE WHAT TO DO
Zebra zebrad 6.4.0 before 7.0.0 rebuilds a transaction's output list once per spent input during the mempool coinbase-maturity check, so the work grows quadratically. Any connected peer can send unsigned transactions with many inputs and outputs, which are rejected without penalty, to keep verification threads busy.
first public Oct 22, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Operators running zebrad 6.4.0 through 6.x that accept inbound peer connections from the internet are exposed, since any connected peer can trigger the slow path. Nodes that only make outbound connections or sit behind a restricted network are less exposed. unknown whether a mitigation other than upgrading is available.
Not affected if outbound-only-peers, version-7-or-later
Who cares self-hosted, zcash, zebra, zebrad
zebrad --version and see whether it falls in 6.4.0 up to but not including 7.0.0.7.0.0 (fixed version per the product range).Zebra zebrad 6.4.0 before 7.0.0 performs quadratic work in the mempool coinbase-maturity check because Transaction::coinbase_spend_restriction() rebuilds the transaction's output list once per spent outpoint. Any connected peer can repeatedly send unsigned transactions with many transparent inputs and outputs, which are rejected without a misbehavior score, to pin verification threads.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.