CVE-2026-123559

Zebra before 7.0.0 contains an inefficient algorithmic complexity vulnerability that allows unauthenticated peers to exhaust verification threads by submitting transactions with many transparent inputs. Attackers can relay invalid transactions with tens of thousands of inputs, forcing quadratic...

CVE-2026-123560

Zebra before 7.0.0 contains an incomplete cleanup vulnerability that allows unauthenticated peers to stall initial sync by serving a forged checkpoint block body. Attackers can supply a body with forged authorizing data near the final checkpoint, leaving rejected hashes in the sent-hash set so th...

CVE-2026-123554

Zebra zebrad 6.4.0 before 7.0.0 performs quadratic work in the mempool coinbase-maturity check because Transaction::coinbasespendrestriction rebuilds the transaction's output list once per spent outpoint. Any connected peer can repeatedly send unsigned transactions with many transparent inputs an...

CVE-2026-123557

ZcashFoundation Zebra zebrad before 7.0.0 contains a reachable assertion race condition that allows unauthenticated remote peers to abort the node by triggering disconnection during a blocked outbound send. Malicious peers can return empty FindBlocks or FindHeaders replies and stop reading their...

CVE-2026-123556

ZcashFoundation Zebra from 4.5.0 before 7.0.0 contains a protection mechanism failure that bans honest peers by scoring mempool lock-time rejections at the ban threshold. Attackers can broadcast transactions locked until the current height right after each block, causing lagging nodes to ban hone...

CVE-2026-123555

Zebra from 2.3.0 before 7.0.0 contains a denial of service vulnerability that allows unauthenticated peers to evade misbehavior scoring by sending transactions or blocks with invalid transparent scripts. Attackers can flood mempool with script-failing transactions or serve forged v5 block bodies...

CVE-2026-123558

Zebra zebrad before 7.0.0 contains a denial of service vulnerability that allows a malicious peer to stall checkpoint sync by cancelling the verifier rewind after a failed commit. Attackers can serve a forged block with altered authorizing data plus a restart-triggering block, leaving the verifie...

EUVD-2026-119445

Zebra before 7.0.0 contains an incomplete cleanup vulnerability that allows unauthenticated peers to stall initial sync by serving a forged checkpoint block body. Attackers can supply a body with forged authorizing data near the final checkpoint, leaving rejected hashes in the sent-hash set so th...

CVE-2026-123560

Zebra versions prior to 7.0.0 are vulnerable to a Denial of Service (DoS) attack due to an incomplete cleanup vulnerability . Unauthenticated peers can stall the initial synchronization process by serving a forged checkpoint block body . Specifically, an attacker can provide a body with forged au...

CVE-2026-123560 Zebra before 7.0.0 Sync Denial of Service via Forged Checkpoint Block Body

Zebra before 7.0.0 contains an incomplete cleanup vulnerability that allows unauthenticated peers to stall initial sync by serving a forged checkpoint block body. Attackers can supply a body with forged authorizing data near the final checkpoint, leaving rejected hashes in the sent-hash set so th...

CVE-2026-123560 Zebra before 7.0.0 Sync Denial of Service via Forged Checkpoint Block Body

Zebra before 7.0.0 contains an incomplete cleanup vulnerability that allows unauthenticated peers to stall initial sync by serving a forged checkpoint block body. Attackers can supply a body with forged authorizing data near the final checkpoint, leaving rejected hashes in the sent-hash set so th...

CVE-2026-123559 Zebra before 7.0.0 Denial of Service via Quadratic Sighash Computation

Zebra before 7.0.0 contains an inefficient algorithmic complexity vulnerability that allows unauthenticated peers to exhaust verification threads by submitting transactions with many transparent inputs. Attackers can relay invalid transactions with tens of thousands of inputs, forcing quadratic...

CVE-2026-123559 Zebra before 7.0.0 Denial of Service via Quadratic Sighash Computation

Zebra before 7.0.0 contains an inefficient algorithmic complexity vulnerability that allows unauthenticated peers to exhaust verification threads by submitting transactions with many transparent inputs. Attackers can relay invalid transactions with tens of thousands of inputs, forcing quadratic...

EUVD-2026-119444

Zebra before 7.0.0 contains an inefficient algorithmic complexity vulnerability that allows unauthenticated peers to exhaust verification threads by submitting transactions with many transparent inputs. Attackers can relay invalid transactions with tens of thousands of inputs, forcing quadratic...

CVE-2026-123559

Zebra versions prior to 7.0.0 are vulnerable to a Denial of Service (DoS) condition caused by an inefficient algorithmic complexity vulnerability (CWE-407). Unauthenticated peers can exhaust verification threads by submitting invalid transactions containing tens of thousands of transparent inputs...

CVE-2026-123558 Zebra before 7.0.0 Checkpoint Sync Denial of Service via Cancelled Verifier Rewind

Zebra zebrad before 7.0.0 contains a denial of service vulnerability that allows a malicious peer to stall checkpoint sync by cancelling the verifier rewind after a failed commit. Attackers can serve a forged block with altered authorizing data plus a restart-triggering block, leaving the verifie...

CVE-2026-123558 Zebra before 7.0.0 Checkpoint Sync Denial of Service via Cancelled Verifier Rewind

Zebra zebrad before 7.0.0 contains a denial of service vulnerability that allows a malicious peer to stall checkpoint sync by cancelling the verifier rewind after a failed commit. Attackers can serve a forged block with altered authorizing data plus a restart-triggering block, leaving the verifie...

CVE-2026-123558 Zebra before 7.0.0 Checkpoint Sync Denial of Service via Cancelled Verifier Rewind

Zebra zebrad before 7.0.0 contains a denial of service vulnerability that allows a malicious peer to stall checkpoint sync by cancelling the verifier rewind after a failed commit. Attackers can serve a forged block with altered authorizing data plus a restart-triggering block, leaving the verifie...

CVE-2026-123558

The Zebra software (versions before 7.0.0 ) is vulnerable to a Denial of Service (DoS) attack during checkpoint synchronization. The root cause involves a cancelled verifier rewind following a failed commit. A malicious peer can exploit this by serving a forged block with altered authorizing data...

EUVD-2026-119443

Zebra zebrad before 7.0.0 contains a denial of service vulnerability that allows a malicious peer to stall checkpoint sync by cancelling the verifier rewind after a failed commit. Attackers can serve a forged block with altered authorizing data plus a restart-triggering block, leaving the verifie...