Vulnerability Description
Zebra zebrad 6.4.0 before 7.0.0 performs quadratic work in the mempool coinbase-maturity check because Transaction::coinbase_spend_restriction() rebuilds the transaction's output list once per spent outpoint. Any connected peer can repeatedly send unsigned transactions with many transparent inputs and outputs, which are rejected without a misbehavior score, to pin verification threads.
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://github.com/ZcashFoundation/zebra/commit/08743d669b33a19bce2a5d54001bd468
- https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-7jp4-mq53-4cvq
- https://www.vulncheck.com/advisories/zebra-zebrad-6.4.0-before-7.0.0-denial-of-s
FAQ
What is CVE-2026-123554?
CVE-2026-123554 is a vulnerability with a CVSS score of 7.5 (HIGH). Zebra zebrad 6.4.0 before 7.0.0 performs quadratic work in the mempool coinbase-maturity check because Transaction::coinbase_spend_restriction() rebuilds the transaction's output list once per spent o...
How severe is CVE-2026-123554?
CVE-2026-123554 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-123554?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.