Zcash Zebra CVE-2026-104426

Exploitation requires an unauthenticated network attacker to either mine a block containing, or seed the public mempool with, roughly 26,000 minimal single-input transactions that force the remaining_transaction_value routine to clone the entire block-level spent-UTXO map per transaction during contextual verification. Limiting factors: only Zebra versions before 6.1.0 are affected; the attacker must be able to get the crafted high-volume transaction set mined or widely propagated (reflected in AC:H and AT:P), which raises the practical bar above a single trivial request despite requiring no authentication or user interaction.

This is a genuine availability-impacting denial-of-service vulnerability (CWE-407, inefficient algorithmic complexity) rather than a high-CVSS-but-low-real-risk theoretical issue, but several signals temper its urgency. The provided CVSS 4.0 vector (AV:N/AC:H/AT:P/PR:N/UI:N) confirms unauthenticated network reachability with no user interaction, but also encodes high attack complexity (AC:H) and a present attack requirement (AT:P) - consistent with the description's need to construct a block of ~26,000 crafted transactions or flood the mempool, which is non-trivial. Impact is availability-only (VA:H, VC:N, VI:N), so there is no confidentiality or integrity exposure despite the 8.2 score. There is no CISA KEV listing and no public exploit identified in the provided data, so there is no evidence of active exploitation - the elevated score is driven by the network-reachable, unauthenticated clog of every validating node (~52+ second stall). Note a tagging conflict: the input Tags include 'Information Disclosure,' which directly contradicts the CVSS vector (VC:N) and the DoS nature of the flaw - the vulnerability is an availability issue, not disclosure. A vendor patch is available (Zebra 6.1.0), making remediation straightforward.

An attacker constructs roughly 26,000 minimal single-input transactions and either mines them into a single block or seeds them into the public mempool. During contextual verification, each transaction triggers a full clone of the block-level spent-UTXO map, causing quadratic blow-up that stalls every validating Zebra node for over 52 seconds. No public exploit code is identified at time of analysis, and the high attack complexity (producing/propagating that transaction volume) limits casual abuse.