Zebra CVE-2026-123555

No configuration change exposes or protects you: the unscored-failure path is present in every zebrad 2.3.0 through 7.0.0-rc.0 node, and any inbound or outbound peer can trigger it after the handshake with no authentication. The mempool flood requires the mempool to be enabled (the default once the node is near the chain tip); the quadratic amplification additionally needs the attacker to own existing transparent outputs to spend (about 1.2 ZEC once to create ~23,500 P2PKH inputs, which are never consumed). The block-sync stall requires the victim to be downloading blocks above the last mandatory checkpoint (initial sync in that range or catching up after downtime) and the attacker's peer to be selected to serve a needed block; the block-gossip variant applies at the tip. Limiting factors: a node already synced past the checkpoint range is exposed only to the gossip and mempool variants; the default network.max_connections_per_ip = 1 and bounding outbound peers reduce exposure; v4-only scriptSig edits fail the Merkle-root check (scored 100), so the block attack requires a v5 transaction; and impact is self-limiting - effects cease when the attack stops. Upgrading to 7.0.0 is the only complete fix (block-sync still idles 67s once per banned address, tracked as #11889).

Signals point to a genuine but bounded availability problem rather than a top-tier emergency. The input CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N, VA:H only) scores 8.7, while the vendor's own GHSA rates it CVSS 3.1 7.5 with the identical availability-only impact (C:N/I:N/A:H); the two agree on mechanism and differ only by scoring version, so the headline 8.7 overstates the practical danger relative to the vendor's 7.5. It is remote, low-complexity and unauthenticated (PR:N), which raises reachability, but the impact is strictly denial of service: the GHSA states no node crash, no state corruption, no change to what the node accepts, and all three effects stop when the attack stops. No EPSS score and no CISA KEV entry are provided in the input, and no confirmed working exploit code is listed, so there is no evidence of active or automated exploitation; the vuln.today Decision label is this_week (not act_now/emergency). Net: a real, patch-this-week priority for Zebra operators syncing above the checkpoint range or running a tip mempool, but not a widespread or data-compromising threat. Missing data to note: EPSS probability absent, KEV status absent (treat as not-listed), and exploit-code availability unconfirmed.

An attacker opens ordinary peer connections to a zebrad node and either floods the mempool with transactions whose transparent scripts fail verification, or serves forged v5 block bodies with a flipped non-coinbase scriptSig byte that leaves the block hash and Merkle root unchanged. Because these script-verification failures collapse to an InternalDowncastError scored 0, the peer is never penalised or banned, so it repeatedly forces full script work (historically quadratic per transaction) or makes the syncer cancel the round and idle 67 seconds. No public working exploit is identified at time of analysis, though the GHSA documents the full mechanism and tests.