CVE-2026-104425

Summary

ZcashFoundation Zebra before 6.1.0 contains a resource exhaustion vulnerability that allows unauthenticated peers to degrade block processing by pushing transactions with invalid Orchard proofs without being misbehavior-scored. Attackers can repeatedly push invalid proofs into the shared halo2 batch verifier, forcing honest block proofs onto the slow individual-verification path and slowing block processing roughly sevenfold.

Affected Software

VendorProductVersion RangeStatus
ZcashFoundationzebra0 < 6.1.0affected
ZcashFoundationzebra6.1.0unaffected

Weaknesses

  • CWE-405: Asymmetric Resource Consumption (Amplification)

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: yes
    • Technical Impact: partial

References