---
id: "CVE-2026-123555"
page: "https://infrastack.ai/live/CVE-2026-123555"
kind: "vulnerability"
aliases: ["CVE-2026-123555"]
title: "Zebra: unauthenticated peers can stall block sync and flood the mempool"
severity: "high"
cvss: 8.7
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "self-hosted", "zcash", "zebra"]
not_affected_if: ["version-7.0.0-or-later"]
published_at: "2026-11-08T02:16:47+00:00"
first_seen_at: "2026-11-08T02:21:11+00:00"
updated_at: "2026-11-08T02:23:10+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-123555", "first_seen_at": "2026-11-08T02:21:11+00:00"}]
exploit_sources: []
---

# Zebra: unauthenticated peers can stall block sync and flood the mempool

Link for people: https://infrastack.ai/live/CVE-2026-123555 (this .md is for agents)

Zebra, a Zcash node implementation, fails to penalize peers that send transactions or blocks with invalid transparent scripts, so the misbehavior score never rises. An unauthenticated attacker can flood the mempool and force CPU exhaustion that repeatedly stalls block sync.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Zebra version against the affected range (2.3.0 up to, but not including, 7.0.0), for example with `zebrad --version`.

## Fix

- Upgrade Zebra to `7.0.0` or later, per the affected range in the sources.

## Timeline

- 2026-11-08T02:21:11+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-123555

## Documents

- [advisory] Vendor advisory: github.com https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-jq45-ghw5-v37x
- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/zebra-2.3.0-before-7.0.0-denial-of-service-via-unscored-script-verification-failures
- [fix] Patch: github.com https://github.com/ZcashFoundation/zebra/commit/e8db87eb69254e0d4eedd058eadd48bdfa09065a

## From the sources

Zebra from 2.3.0 before 7.0.0 contains a denial of service vulnerability that allows unauthenticated peers to evade misbehavior scoring by sending transactions or blocks with invalid transparent scripts. Attackers can flood mempool with script-failing transactions or serve forged v5 block bodies with altered scriptSig bytes to exhaust CPU and repeatedly stall block sync.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_