CVE-2026-123559 Zebra before 7.0.0 Denial of Service via Quadratic Sighash Computation
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-123559?
CVE-2026-123559 is a high-severity vulnerability in ZcashFoundation zebra, published on 8 Nov 2026.
Official description
Zebra before 7.0.0 contains an inefficient algorithmic complexity vulnerability that allows unauthenticated peers to exhaust verification threads by submitting transactions with many transparent inputs. Attackers can relay invalid transactions with tens of thousands of inputs, forcing quadratic ZIP-244 or ZIP-243 digest recomputation that stalls Rayon-backed block verification for minutes.
Weakness: CWE-407
Which versions are affected by CVE-2026-123559?
How do I fix CVE-2026-123559?
No fix has been published for CVE-2026-123559 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-123559 being exploited?
There is no known exploitation of CVE-2026-123559 in the wild and no public exploit code.
Sources
Also known as GHSA-j4cw-58mj-7w6v, GHSA-wgc2-xcwr-9pcw.