Zebra 2.3.0 before 7.0.0 Denial of Service via Unscored Script Verification Failures
Affects zebrad 2.3.0 or later before 7.0.0, including 7.0.0-rc.0. Fixed in Zebra 7.0.0.
Written by anthropic/claude-haiku-5.5 from the sources below. Verify against them.
- Exploited
- No known exploitation
- Fix
- Fixed in 7.0.0, 18.0.0
- Who is exposed
- Default setups
Do first: Check every install: default setups are affected.
- Last modified
- FIRST's estimate of the chance attackers exploit it in the next 30 days, updated daily.What do these mean? →
- 0.43% · 37th percentile
- A 0-100 score for how much a CVE matters across the industry: exploitation, exposure, how widely the software is used, severity and whether a fix exists.What do these mean? →
- 31/100 · provisional
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Default setups
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
Zebra from 2.3.0 before 7.0.0 contains a denial of service vulnerability that allows unauthenticated peers to evade misbehavior scoring by sending transactions or blocks with invalid transparent scripts. Attackers can flood mempool with script-failing transactions or serve forged v5 block bodies with altered scriptSig bytes to exhaust CPU and repeatedly stall block sync.
cve.now Index
- Exploitation?/40Unknown. No CISA SSVC exploitation rating yet
- Exposure22/25Default setups, reachable over the network without a login
- Reach?/20Unknown. No tracked technology or package matched
- Severity8.7/10CVSS 8.7
- No patch0/5No signal
What would change the score
- Would score about 71 if added to CISA KEV
- Would score about 66 if CISA's SSVC rates exploitation active
What to do
Check every install: default setups are affected.
Upgrade to a fixed version: 7.0.0, 18.0.0.
A source says this fix is incomplete.Workaround: Operators can reduce exposure by keeping the default network.max_connections_per_ip = 1, bounding outbound connections with network.peerset_initial_target_size, and watching the mempool.full_queue.per_peer.total metric.
Timeline
- CVE published
- First seen by cve.now
Affected versions
- ZcashFoundation zebra
From 2.3.0 · fixed in 7.0.0
- ZcashFoundation zebra
From 1.0.0-beta.46 · fixed in 18.0.0
Evidence 3
- Advisory
- Patch
- Link
Corrections
None so far.
Something wrong on this page? Report an error. Every fix is listed here.
Questions about CVE-2026-123555
Is CVE-2026-123555 being exploited?
It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.Source: cve.now feed data
What does this mean?
A connected peer can send unlimited transactions with invalid transparent scripts without being scored or banned, which forces the node to spend CPU on full script verification. A peer can also serve forged block bodies to repeatedly stall block sync for a node syncing above the last mandatory checkpoint, again without being scored.Source: github.com
Which versions are affected by CVE-2026-123555?
zebra: from 2.3.0 before 7.0.0. zebra: from 1.0.0-beta.46 before 18.0.0.Source: cve.now feed data
Am I affected, and how do I check?
Zebra 2.3.0 or later, before 7.0.0, including 7.0.0-rc.0. The mempool path needs the mempool enabled, which is the default once the node is near the chain tip. The block-sync path applies to a node downloading blocks above the last mandatory checkpoint. Check the zebrad version you run against these ranges.Source: github.com
How do I fix CVE-2026-123555?
Upgrade to Zebra 7.0.0.Source: github.com
Is the fix complete?
The advisory says the issue is fixed in Zebra 7.0.0. The fix data is marked as partial, but the sources do not say which part remains unfixed.Source: github.com