Is CVE-2026-104426 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-104426 being exploited in the wild.

How severe is CVE-2026-104426?

Medium severity, with a CVSS score of 5.9, published 2 October 2026.

Which products and versions are affected?

ZcashFoundation Zebra before 6.1.0.

Is there a fix for CVE-2026-104426?

Yes: fixed in 6.1.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-104426 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-104426?

Check whether you run ZcashFoundation Zebra at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-104426: Zebra inefficient algorithmic complexity in block validation

CVE-2026-104426 · Severity: medium · CVSS 5.9 · Published 2026-10-02

Zebra is a cryptocurrency node implementation that validates blockchain blocks. An attacker can craft a malicious block containing roughly 26,000 minimal transactions that causes the validation process to stall for over 52 seconds on typical hardware, effectively creating a denial-of-service against network nodes. The stall is temporary and does not corrupt data or crash the software, but significantly impacts node responsiveness.

Vendors: ZcashFoundation.

Quick answers

Is CVE-2026-104426 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-104426 being exploited in the wild.
How severe is CVE-2026-104426?: Medium severity, with a CVSS score of 5.9, published 2 October 2026.
Which products and versions are affected?: ZcashFoundation Zebra before 6.1.0.
Is there a fix for CVE-2026-104426?: Yes: fixed in 6.1.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-104426 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-104426?: Check whether you run ZcashFoundation Zebra at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 6.1.0

Technical details

The vulnerability is an inefficient algorithmic complexity flaw (CWE-407) in the remaining_transaction_value function within utxo.rs. The code clones and converts the entire block-level spent-UTXO map once per transaction during contextual verification, resulting in O(N²) complexity instead of linear O(N). An attacker must produce a valid proof-of-work block or seed the mempool with single-input transactions; the malicious block must pass proof-of-work validation before reaching the vulnerable code path.

Affected products

ZcashFoundation Zebra before 6.1.0

Timeline

2026-07-17: disclosed: GitHub security advisory GHSA-4g24-549m-hp75 published
2026-10-02: advisory: CVE-2026-104426 published on NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.