CVE-2026-104426: Zcashfoundation Zebra

Medium severity, CVSS 5.9. EPSS: 0.3% chance of exploitation in the next 30 days.

Zebra before 6.1.0 contains an inefficient algorithmic complexity vulnerability in remaining_transaction_value that clones the entire block-level spent-UTXO map per transaction during contextual verification. Attackers can mine or seed the mempool with roughly 26,000 minimal single-input transactions in one block, stalling every validating node for over 52 seconds.

Affected products

• Zcashfoundation Zebra: before 6.1.0 (fixed in 6.1.0)

Published 2026-10-02. Last modified 2026-10-02.