Zebra v6.0.0 Orchard Proof Verification DoS via Pushed Transaction Poisoning (CVE-Related)

Vulnerability Overview Title: Unattributed pushed-transaction verification failures allow sustained batch-verification poisoning of block processing Description: When directly pushed mempool transaction verification fails, Zebra does not log the address of the sending peer; therefore, that peer is never marked as a misbehaving node or banned. Since Orchard proof verification runs through a process-global batch verifier shared between mempool transaction verification and block processing, a peer can repeatedly push transactions carrying invalid Orchard proofs. This causes batch verification failures, forcing Zebra to re-verify each transaction individually, resulting in sustained degradation of block processing performance. Scope Affected Versions: v6.0.0-rc0 and v6.0.0 (the version introducing attribution behavior) Fixed Version: 6.1.0 Severity: Medium CVSS 3.1: AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CWE: CWE-770 (Unrestricted Resource Allocation), CWE-405 (Asymmetric Resource Consumption) Reporter: Partner disclosure (@ebfull and @ValarDragon) Fix PR: #10995 Remediation Patch: The primary fix attributes pushed-transaction verification failures to the sending peer. By threading the (which is already in scope) into the pushed branch, the error carries the peer address, allowing the existing misbehavior banning mechanism to function. Workarounds: There is no configuration-only workaround; the affected path is standard mempool transaction handling. Limiting inbound peer connections restricts exposure. Upgrading once a patch is available provides a durable fix. Code Blocks

Goal Reached Thanks to every supporter — we hit 100%!

Zebra v6.0.0 Orchard Proof Verification DoS via Pushed Transaction Poisoning (CVE-Related)

More from this source