CVE-2026-123559— Zebra before 7.0.0 Denial of Service via Quadratic Sighash Computation

Quick assessment

Affected

ZcashFoundation zebra

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Zebra 7.0.0 之前的版本存在算法复杂度效率低下的漏洞，允许未认证的同行节点通过提交包含大量透明输入的交易，耗尽验证线程。攻击者可广播包含数万个输入的无效交易，迫使系统进行二次复杂度的 ZIP-244 或 ZIP-243 摘要重新计算，从而导致基于 Rayon 的区块验证停滞数分钟。

CVSS 7.5 · High Updated Nov 08, 2026

Possible ATT&CK Techniques 1 AI

T1499 · Endpoint Denial of Service

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Zebra before 7.0.0 Denial of Service via Quadratic Sighash Computation

Source: CVE Program / CVE List V5

Vulnerability Description

Zebra before 7.0.0 contains an inefficient algorithmic complexity vulnerability that allows unauthenticated peers to exhaust verification threads by submitting transactions with many transparent inputs. Attackers can relay invalid transactions with tens of thousands of inputs, forcing quadratic ZIP-244 or ZIP-243 digest recomputation that stalls Rayon-backed block verification for minutes.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Source: CVE Program / CVE List V5

Vulnerability Type

算法复杂性

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
ZcashFoundation	zebra	0 ~ 7.0.0	-

II. Public POCs for CVE-2026-123559

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-123559

请登录查看更多情报信息。

Other References for CVE-2026-123559 (2)

https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-j4cw-58mj-7w6v vendor-advisory
https://www.vulncheck.com/advisories/zebra-before-7.0.0-denial-of-service-via-quadratic-sighash-computation third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-123559

Same Patch Batch · ZcashFoundation · 2026-11-08 · 7 CVEs total

CVE-2026-123555	7.5 HIGH	Zebra 2.3.0 before 7.0.0 Denial of Service via Unscored Script Verification Failures
CVE-2026-123558	7.5 HIGH	Zebra before 7.0.0 Checkpoint Sync Denial of Service via Cancelled Verifier Rewind
CVE-2026-123554	7.5 HIGH	Zebra zebrad 6.4.0 before 7.0.0 Denial of Service via Mempool Coinbase-Maturity Check
CVE-2026-123560	7.5 HIGH	Zebra before 7.0.0 Sync Denial of Service via Forged Checkpoint Block Body
CVE-2026-123557	5.9 MEDIUM	Zebra zebrad before 7.0.0 Reachable Assertion DoS via Peer Disconnection
CVE-2026-123556	5.3 MEDIUM	Zebra 4.5.0 before 7.0.0 Honest Peer Ban via Mempool Lock-Time Scoring

IV. Related Vulnerabilities

Same product: zebra

Same vendor: ZcashFoundation

Same weakness: CWE-407