Zcash Zebra CVE-2026-123554

Exploitation requires the target to run zebrad 6.4.0, 6.4.1, 6.4.2 or 7.0.0-rc.0 with networking enabled, which is the default on every network - the advisory states no configuration setting changes exposure. Any connected peer, inbound or outbound and without authentication, funds, or valid signatures, can trigger it by sending a transaction with many transparent inputs and empty scriptSigs plus many transparent outputs, because the maturity check runs before the standardness check that would reject it, and the resulting policy rejection carries no misbehavior score so the peer is never banned and can repeat indefinitely. Limiting factors: only the narrow 6.4.x / 7.0.0-rc.0 version window is vulnerable (6.3.x and 7.0.0+ are not); impact is availability-only with automatic recovery once the attack stops; and per-transaction CPU cost, while severe (~20s), is self-limited to five queued transactions per connection.

This is a genuine but bounded availability-only denial-of-service issue, not a high-CVSS paper risk and not a widespread emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H, 8.7) and the vendor's own CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5) agree on the mechanism: a remote, unauthenticated peer (PR:N) can trivially (AC:L/AT:N) degrade availability (VA:H / A:H) with no confidentiality or integrity impact. The score gap is purely a scoring-model artifact (CVSS 4.0 weights a clean network availability loss higher), not conflicting intelligence. No EPSS score and no KEV status were supplied, and there is no public working exploit - the only known reproduction is the private one from reporter @janneh2000 - so this is not confirmed active exploitation. The vuln.today decision label is 'this_week', consistent with a patch-available, remotely triggerable DoS that is not under active exploitation. Mitigating the urgency: the exposure window is narrow (only zebrad 6.4.0/6.4.1/6.4.2 and 7.0.0-rc.0; 6.3.x and earlier are unaffected), the node recovers automatically when the attack stops, no funds or consensus rules are at risk, and nothing is written to disk. The affected tag 'Information Disclosure' is inconsistent with the VC:N/C:N impact and should be disregarded.

A remote unauthenticated peer connects to a Zebra node (inbound or outbound connection, the default on every network) and submits an unsigned ~2 MB transaction carrying tens of thousands of transparent inputs and outputs with empty scriptSigs. The mempool coinbase-maturity check performs O(inputs × outputs) work before the transaction is rejected, pinning a verification worker for roughly 20 seconds per transaction and up to five queued at once, stalling block verification, sync, and peer handling. No public weaponized exploit is identified, but the reporter demonstrated a working reproduction (24,000 inputs / 111,000 outputs on a 4-core machine).