CVE-2026-123555 · Package
NO FIX YET · SEE WHAT TO DO
Zebra, a Zcash node implementation, fails to penalize peers that send transactions or blocks with invalid transparent scripts, so the misbehavior score never rises. An unauthenticated attacker can flood the mempool and force CPU exhaustion that repeatedly stalls block sync.
first public Oct 22, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Operators running Zebra 2.3.0 through 6.x as a Zcash node that accepts peer connections from the network. Nodes running a fixed version are not affected. Sources do not say whether non-default settings change exposure.
Not affected if version-7.0.0-or-later
Who cares self-hosted, zcash, zebra
zebrad --version.7.0.0 or later, per the affected range in the sources.Zebra from 2.3.0 before 7.0.0 contains a denial of service vulnerability that allows unauthenticated peers to evade misbehavior scoring by sending transactions or blocks with invalid transparent scripts. Attackers can flood mempool with script-failing transactions or serve forged v5 block bodies with altered scriptSig bytes to exhaust CPU and repeatedly stall block sync.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.