Is CVE-2026-104425 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-104425 being exploited in the wild.

How severe is CVE-2026-104425?

Medium severity, with a CVSS score of 5.3, published 2 October 2026.

Which products and versions are affected?

Zcash Foundation Zebra before 6.1.0, specifically 6.0.0 and 6.0.0-rc.0.

Is there a fix for CVE-2026-104425?

Yes: fixed in 6.1.0. Until then: Restricting inbound peer connections limits exposure to the attack until an upgrade is available. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-104425 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-104425?

Check whether you run Zcash Foundation Zebra at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-104425: Zcash Foundation Zebra resource exhaustion in Orchard proof verification

CVE-2026-104425 · Severity: medium · CVSS 5.3 · Published 2026-10-02

Zebra is a node implementation for the Zcash blockchain that validates transactions and blocks. An attacker can send transactions with fake cryptographic proofs to a Zebra node, degrading its ability to process legitimate blocks and slowing verification by roughly sevenfold. The attack requires no authentication and can be sustained indefinitely from a single connection, disrupting network consensus participation.

Technologies: Zcash Foundation Zebra. Vendors: Zcash Foundation.

Quick answers

Is CVE-2026-104425 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-104425 being exploited in the wild.
How severe is CVE-2026-104425?: Medium severity, with a CVSS score of 5.3, published 2 October 2026.
Which products and versions are affected?: Zcash Foundation Zebra before 6.1.0, specifically 6.0.0 and 6.0.0-rc.0.
Is there a fix for CVE-2026-104425?: Yes: fixed in 6.1.0. Until then: Restricting inbound peer connections limits exposure to the attack until an upgrade is available. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-104425 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-104425?: Check whether you run Zcash Foundation Zebra at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 6.1.0

Restricting inbound peer connections limits exposure to the attack until an upgrade is available.

Technical details

The vulnerability is a resource exhaustion flaw in Orchard proof verification that exploits an attribution gap: when directly-pushed mempool transactions fail verification, the sending peer address is not recorded, so misbehavior scoring never triggers and the peer is never banned. Because the shared process-global halo2 batch verifier handles both mempool and block verification, an attacker can repeatedly inject invalid Orchard proofs from an unauthenticated peer connection. Each invalid proof causes the batch to fail, forcing all proofs in the batch—including legitimate block proofs—onto the slow individual-verification path, amplifying the attack's impact sevenfold.

Affected products

Zcash Foundation Zebra before 6.1.0, specifically 6.0.0 and 6.0.0-rc.0

Timeline

2026-07-17: disclosed
2026-10-02: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.