---
id: "CVE-2026-123559"
page: "https://infrastack.ai/live/CVE-2026-123559"
kind: "vulnerability"
aliases: ["CVE-2026-123559"]
title: "Zebra: crafted transactions stall block verification for minutes, DoS"
severity: "high"
cvss: 8.7
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["runtime", "self-hosted", "zcash", "zebra"]
not_affected_if: ["no-public-peer-access", "zebra-7.0.0-or-later"]
published_at: "2026-11-08T02:16:48+00:00"
first_seen_at: "2026-11-08T02:21:11+00:00"
updated_at: "2026-11-08T02:23:07+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-123559", "first_seen_at": "2026-11-08T02:21:11+00:00"}]
exploit_sources: []
---

# Zebra: crafted transactions stall block verification for minutes, DoS

Link for people: https://infrastack.ai/live/CVE-2026-123559 (this .md is for agents)

Zebra, a Zcash node implementation, does not limit the work needed to verify transactions with many transparent inputs. An unauthenticated peer can relay invalid transactions that force quadratic digest recomputation and stall block verification for minutes.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the Zebra version in use; affected versions are those before `7.0.0`.
- Confirm the node accepts peer connections from the public internet.

## Fix

- Zebra: move to `7.0.0` or later.

## Timeline

- 2026-11-08T02:21:11+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-123559

## Documents

- [advisory] Vendor advisory: github.com https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-j4cw-58mj-7w6v
- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/zebra-before-7.0.0-denial-of-service-via-quadratic-sighash-computation

## From the sources

Zebra before 7.0.0 contains an inefficient algorithmic complexity vulnerability that allows unauthenticated peers to exhaust verification threads by submitting transactions with many transparent inputs. Attackers can relay invalid transactions with tens of thousands of inputs, forcing quadratic ZIP-244 or ZIP-243 digest recomputation that stalls Rayon-backed block verification for minutes.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_