{"id":"CVE-2026-123554","kind":"vulnerability","aliases":["CVE-2026-123554"],"related":[],"title":"Zebra: mempool coinbase check lets peers pin CPU threads","description":"Zebra zebrad 6.4.0 before 7.0.0 performs quadratic work in the mempool coinbase-maturity check because Transaction::coinbase_spend_restriction() rebuilds the transaction's output list once per spent outpoint. Any connected peer can repeatedly send unsigned transactions with many transparent inputs and outputs, which are rejected without a misbehavior score, to pin verification threads.","summary":"Zebra zebrad 6.4.0 before 7.0.0 rebuilds a transaction's output list once per spent input during the mempool coinbase-maturity check, so the work grows quadratically. Any connected peer can send unsigned transactions with many inputs and outputs, which are rejected without penalty, to keep verification threads busy.","severity":"high","cvss":8.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["runtime","self-hosted","zcash","zebra","zebrad"],"not_affected_if":["outbound-only-peers","version-7-or-later"],"how_to_check":"- Check the running zebrad version with `zebrad --version` and see whether it falls in 6.4.0 up to but not including `7.0.0`.\n- Confirm the node accepts peer connections from the internet (default P2P port exposed).","fix":"- Zebra `7.0.0` (fixed version per the product range).","status":"open","published_at":"2026-11-08T02:16:47+00:00","first_seen_at":"2026-11-08T02:21:11+00:00","triaged_at":"2026-11-08T02:23:10+00:00","updated_at":"2026-11-08T02:23:10+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-11-08T02:23:10Z","model":"claude-haiku-5-5","output":{"fix":"- Zebra `7.0.0` (fixed version per the product range).","reach":"internet","title":"Zebra: mempool coinbase check lets peers pin CPU threads","impact":"low","summary":"Zebra zebrad 6.4.0 before 7.0.0 rebuilds a transaction's output list once per spent input during the mempool coinbase-maturity check, so the work grows quadratically. Any connected peer can send unsigned transactions with many inputs and outputs, which are rejected without penalty, to keep verification threads busy.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["zebra","zebrad","zcash","self-hosted"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"Peers can tie up verification threads, degrading node availability","analyst_note":"","how_to_check":"- Check the running zebrad version with `zebrad --version` and see whether it falls in 6.4.0 up to but not including `7.0.0`.\n- Confirm the node accepts peer connections from the internet (default P2P port exposed).","plain_action":"","needs_analyst":false,"not_affected_if":["outbound-only-peers","version-7-or-later"],"who_is_affected":"Operators running zebrad 6.4.0 through 6.x that accept inbound peer connections from the internet are exposed, since any connected peer can trigger the slow path. Nodes that only make outbound connections or sit behind a restricted network are less exposed. unknown whether a mitigation other than upgrading is available.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000716,"input_tokens":4323,"output_tokens":567,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-123554':12A,15A '-2026':11A,14A '6.4.0':25B,74C '7.0.0':27B,76C 'busi':71B 'check':4A,44B,86C 'coinbas':3A,42B,84C,89C 'coinbase-matur':41B,83C 'connect':51B,103C 'cpu':8A 'cve':10A,13A 'grow':48B 'host':19B 'input':37B,59B,113C 'keep':68B 'let':5A 'list':33B,97C 'mani':58B,111C 'matur':43B,85C 'mempool':2A,40B,82C 'misbehavior':121C 'outpoint':101C 'output':32B,61B,96C,115C 'peer':6A,52B,104C 'penalti':66B 'per':35B,99C 'perform':77C 'pin':7A,124C 'quadrat':49B,78C 'rebuild':28B,92C 'reject':64B,118C 'repeat':106C 'restrict':91C 'runtim':16B 'score':122C 'self':18B 'self-host':17B 'send':54B,107C 'spend':90C 'spent':36B,100C 'thread':9A,70B,126C 'transact':30B,56B,88C,94C,109C 'transpar':112C 'unsign':55B,108C 'verif':69B,125C 'without':65B,119C 'work':47B,79C 'zcash':20B 'zebra':1A,21B,23B,72C 'zebrad':22B,24B,73C","nicknames":[],"mitigations":[],"who_affected":"Operators running zebrad 6.4.0 through 6.x that accept inbound peer connections from the internet are exposed, since any connected peer can trigger the slow path. Nodes that only make outbound connections or sit behind a restricted network are less exposed. unknown whether a mitigation other than upgrading is available.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","runtime","selfhosted","zcash","zebra","zebrad"],"campaign_type":null,"search_a":"'-123554':12A,15A '-2026':11A,14A 'check':4A 'coinbas':3A 'cpu':8A 'cve':10A,13A 'let':5A 'mempool':2A 'peer':6A 'pin':7A 'thread':9A 'zebra':1A","search_b":"'6.4.0':25B '7.0.0':27B 'busi':71B 'check':44B 'coinbas':42B 'coinbase-matur':41B 'connect':51B 'grow':48B 'host':19B 'input':37B,59B 'keep':68B 'list':33B 'mani':58B 'matur':43B 'mempool':40B 'output':32B,61B 'peer':52B 'penalti':66B 'per':35B 'quadrat':49B 'rebuild':28B 'reject':64B 'runtim':16B 'self':18B 'self-host':17B 'send':54B 'spent':36B 'thread':70B 'transact':30B,56B 'unsign':55B 'verif':69B 'without':65B 'work':47B 'zcash':20B 'zebra':21B,23B 'zebrad':22B,24B","search_c":"'6.4.0':74C '7.0.0':76C 'check':86C 'coinbas':84C,89C 'coinbase-matur':83C 'connect':103C 'input':113C 'list':97C 'mani':111C 'matur':85C 'mempool':82C 'misbehavior':121C 'outpoint':101C 'output':96C,115C 'peer':104C 'per':99C 'perform':77C 'pin':124C 'quadrat':78C 'rebuild':92C 'reject':118C 'repeat':106C 'restrict':91C 'score':122C 'send':107C 'spend':90C 'spent':100C 'thread':126C 'transact':88C,94C,109C 'transpar':112C 'unsign':108C 'verif':125C 'without':119C 'work':79C 'zebra':72C 'zebrad':73C","first_public_at":"2026-10-22T14:55:09+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123554","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123554","severity":null,"published_at":"2026-11-08T02:16:47+00:00","modified_at":"2026-11-08T02:16:47+00:00","first_seen_at":"2026-11-08T02:21:11+00:00","fetched_at":"2026-11-08T02:21:11+00:00","note":null}],"documents":[{"id":99257,"url":"https://github.com/ZcashFoundation/zebra/commit/08743d669b33a19bce2a5d54001bd468c03a196e","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":99258,"url":"https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-7jp4-mq53-4cvq","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-22T14:55:09+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":99259,"url":"https://www.vulncheck.com/advisories/zebra-zebrad-6.4.0-before-7.0.0-denial-of-service-via-mempool-coinbase-maturity-check","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}