Zcash Zebra CVE-2026-104423

Exploitation requires a zebrad node (version before 6.2.1) that accepts inbound peer connections and participates in mempool transaction relay - the normal operating mode for a Zcash full node on the P2P network. No authentication, credentials, or user interaction are needed (PR:N/UI:N): any unauthenticated peer can push V6 transactions with invalid zero-filled Orchard/Ironwood Halo2 proofs into the shared unprioritized verification queue. The primary limiting factors are that the node must be network-reachable and running an affected version, and that impact is confined to availability (verification stalling / falling behind the chain tip) rather than data compromise; nodes not exposed to untrusted peers or already upgraded to 6.2.1 are not exploitable.

This is a genuine availability-focused priority for affected Zcash node operators, though not a universal emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H) is internally consistent with the description: a network-reachable, unauthenticated peer can trivially flood the shared unprioritized Halo2 verification queue, and the impact is confined to availability (VA:H) with no confidentiality or integrity effect - consistent with CWE-405 (asymmetric resource consumption). The low attack complexity and lack of any authentication or user interaction make exploitation mechanically easy, which drives the 8.7 score. However, no EPSS probability, KEV listing, or POC availability is present in the input, so there is no evidence of active or at-scale exploitation - status is 'no public exploit identified at time of analysis.' The 'Information Disclosure' tag directly contradicts the CVSS vector (VC:N) and CWE-405; this appears to be a mislabel and should not factor into risk. Net: treat as a high-urgency DoS patch for internet-facing Zcash nodes, but real-world blast radius is bounded by the niche deployment footprint of Zebra rather than any disclosure or RCE exposure.

An attacker opens unauthenticated peer connections to one or more internet-reachable zebrad nodes running a version before 6.2.1 and continuously relays zero-fee V6 mempool transactions carrying zero-filled Orchard and Ironwood (Halo2) proofs. Because these invalid proofs enter the same unprioritized verification queue as legitimate work, the node spends CPU validating junk and falls behind the chain tip. No public exploit code is identified at time of analysis, but the attack requires only standard P2P message crafting.