{"id":"CVE-2026-123555","kind":"vulnerability","aliases":["CVE-2026-123555"],"related":[],"title":"Zebra: unauthenticated peers can stall block sync and flood the mempool","description":"Zebra from 2.3.0 before 7.0.0 contains a denial of service vulnerability that allows unauthenticated peers to evade misbehavior scoring by sending transactions or blocks with invalid transparent scripts. Attackers can flood mempool with script-failing transactions or serve forged v5 block bodies with altered scriptSig bytes to exhaust CPU and repeatedly stall block sync.","summary":"Zebra, a Zcash node implementation, fails to penalize peers that send transactions or blocks with invalid transparent scripts, so the misbehavior score never rises. An unauthenticated attacker can flood the mempool and force CPU exhaustion that repeatedly stalls block sync.","severity":"high","cvss":8.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","zcash","zebra"],"not_affected_if":["version-7.0.0-or-later"],"how_to_check":"- Check the installed Zebra version against the affected range (2.3.0 up to, but not including, 7.0.0), for example with `zebrad --version`.","fix":"- Upgrade Zebra to `7.0.0` or later, per the affected range in the sources.","status":"open","published_at":"2026-11-08T02:16:47+00:00","first_seen_at":"2026-11-08T02:21:11+00:00","triaged_at":"2026-11-08T02:23:10+00:00","updated_at":"2026-11-08T02:23:10+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-08T02:23:10Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Zebra to `7.0.0` or later, per the affected range in the sources.","reach":"internet","title":"Zebra: unauthenticated peers can stall block sync and flood the mempool","impact":"medium","summary":"Zebra, a Zcash node implementation, fails to penalize peers that send transactions or blocks with invalid transparent scripts, so the misbehavior score never rises. An unauthenticated attacker can flood the mempool and force CPU exhaustion that repeatedly stalls block sync.","audience":"businesses","category":"package","nicknames":[],"who_cares":["zebra","zcash","self-hosted"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"Remote peers repeatedly stall block sync and exhaust node CPU.","analyst_note":"Confirm the fixed version and whether the flaw is exploitable beyond sync stalls by reading the vendor advisory and the patch link in the sources.","how_to_check":"- Check the installed Zebra version against the affected range (2.3.0 up to, but not including, 7.0.0), for example with `zebrad --version`.\n- Unknown whether the sources name a configuration that changes exposure.","plain_action":"","needs_analyst":true,"not_affected_if":["version-7.0.0-or-later"],"who_is_affected":"Operators running Zebra 2.3.0 through 6.x as a Zcash node that accepts peer connections from the network. Nodes running a fixed version are not affected. Sources do not say whether non-default settings change exposure.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000722,"input_tokens":4322,"output_tokens":579,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-123555':14A,17A '-2026':13A,16A '2.3.0':66C '7.0.0':68C 'allow':76C 'alter':108C 'attack':50B,92C 'block':6A,37B,62B,87C,105C,117C 'bodi':106C 'byte':110C 'contain':69C 'cpu':57B,113C 'cve':12A,15A 'denial':71C 'evad':80C 'exhaust':58B,112C 'fail':29B,99C 'flood':9A,52B,94C 'forc':56B 'forg':103C 'host':21B 'implement':28B 'invalid':39B,89C 'mempool':11A,54B,95C 'misbehavior':44B,81C 'never':46B 'node':27B 'packag':18B 'peer':3A,32B,78C 'penal':31B 'repeat':60B,115C 'rise':47B 'score':45B,82C 'script':41B,91C,98C 'script-fail':97C 'scriptsig':109C 'self':20B 'self-host':19B 'send':34B,84C 'serv':102C 'servic':73C 'stall':5A,61B,116C 'sync':7A,63B,118C 'transact':35B,85C,100C 'transpar':40B,90C 'unauthent':2A,49B,77C 'v5':104C 'vulner':74C 'zcash':22B,26B 'zebra':1A,23B,24B,64C","nicknames":[],"mitigations":[],"who_affected":"Operators running Zebra 2.3.0 through 6.x as a Zcash node that accepts peer connections from the network. Nodes running a fixed version are not affected. Sources do not say whether non-default settings change exposure.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","package","selfhosted","zcash","zebra"],"campaign_type":null,"search_a":"'-123555':14A,17A '-2026':13A,16A 'block':6A 'cve':12A,15A 'flood':9A 'mempool':11A 'peer':3A 'stall':5A 'sync':7A 'unauthent':2A 'zebra':1A","search_b":"'attack':50B 'block':37B,62B 'cpu':57B 'exhaust':58B 'fail':29B 'flood':52B 'forc':56B 'host':21B 'implement':28B 'invalid':39B 'mempool':54B 'misbehavior':44B 'never':46B 'node':27B 'packag':18B 'peer':32B 'penal':31B 'repeat':60B 'rise':47B 'score':45B 'script':41B 'self':20B 'self-host':19B 'send':34B 'stall':61B 'sync':63B 'transact':35B 'transpar':40B 'unauthent':49B 'zcash':22B,26B 'zebra':23B,24B","search_c":"'2.3.0':66C '7.0.0':68C 'allow':76C 'alter':108C 'attack':92C 'block':87C,105C,117C 'bodi':106C 'byte':110C 'contain':69C 'cpu':113C 'denial':71C 'evad':80C 'exhaust':112C 'fail':99C 'flood':94C 'forg':103C 'invalid':89C 'mempool':95C 'misbehavior':81C 'peer':78C 'repeat':115C 'score':82C 'script':91C,98C 'script-fail':97C 'scriptsig':109C 'send':84C 'serv':102C 'servic':73C 'stall':116C 'sync':118C 'transact':85C,100C 'transpar':90C 'unauthent':77C 'v5':104C 'vulner':74C 'zebra':64C","first_public_at":"2026-10-22T13:13:05+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123555","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123555","severity":null,"published_at":"2026-11-08T02:16:47+00:00","modified_at":"2026-11-08T02:16:47+00:00","first_seen_at":"2026-11-08T02:21:11+00:00","fetched_at":"2026-11-08T02:21:11+00:00","note":null}],"documents":[{"id":99260,"url":"https://github.com/ZcashFoundation/zebra/commit/e8db87eb69254e0d4eedd058eadd48bdfa09065a","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":99261,"url":"https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-jq45-ghw5-v37x","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-22T13:13:05+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":99262,"url":"https://www.vulncheck.com/advisories/zebra-2.3.0-before-7.0.0-denial-of-service-via-unscored-script-verification-failures","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}