CVE-2026-123554 Zebra zebrad 6.4.0 before 7.0.0 Denial of Service via Mempool Coinbase-Maturity Check

High 8.7 Published 8 Nov 2026 Updated 9 Nov 2026

Exploited in the wild: Not known
Fix: None listed

What is CVE-2026-123554?

CVE-2026-123554 is a high-severity vulnerability in ZcashFoundation zebra, published on 8 Nov 2026.

Official description

Zebra zebrad 6.4.0 before 7.0.0 performs quadratic work in the mempool coinbase-maturity check because Transaction::coinbase_spend_restriction() rebuilds the transaction's output list once per spent outpoint. Any connected peer can repeatedly send unsigned transactions with many transparent inputs and outputs, which are rejected without a misbehavior score, to pin verification threads.

Weakness: CWE-407

Which versions are affected by CVE-2026-123554?

How do I fix CVE-2026-123554?

No fix has been published for CVE-2026-123554 yet. Limit exposure of the affected software until one is available.

Is CVE-2026-123554 being exploited?

There is no known exploitation of CVE-2026-123554 in the wild and no public exploit code.

Sources

Also known as GHSA-5872-wrc4-qh77, GHSA-7jp4-mq53-4cvq.