CVE-2026-104431 Zebra before 6.0.0 Denial of Service via Synchronous Script FFI Verification
Unauthenticated attackers can cause denial of service in Zebra nodes by submitting expensive transactions that stall worker threads.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-104431?
CVE-2026-104431 is a high-severity denial of service vulnerability in ZcashFoundation zebra, published on 2 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Zebra before 6.0.0 contains a denial of service vulnerability that allows unauthenticated peers to stall Tokio workers by submitting mempool transactions requiring expensive synchronous script verification. Attackers can send non-standard high-sigop P2SH transactions that reach CachedFfiTransaction::is_valid() before standardness checks, saturating the verifier buffer and rendering the node unresponsive.
Weakness: CWE-405
Which versions are affected by CVE-2026-104431?
How do I fix CVE-2026-104431?
No fix has been published for CVE-2026-104431 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-104431 being exploited?
There is no known exploitation of CVE-2026-104431 in the wild and no public exploit code.
Sources
Also known as GHSA-84j3-rw4c-gqmj, GHSA-ppfj-6m85-xq47.