Is CVE-2026-104431 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-104431 being exploited in the wild.

How severe is CVE-2026-104431?

High severity, with a CVSS score of 7.5, published 2 October 2026.

Which products and versions are affected?

Zcash Foundation Zebra before 6.0.0.

How is CVE-2026-104431 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-104431?

Check whether you run Zcash Foundation Zebra at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-104431: Zebra denial of service in mempool transaction verification

CVE-2026-104431 · Severity: high · CVSS 7.5 · Published 2026-10-02

Zebra is a Zcash cryptocurrency node implementation. A remote attacker can submit specially crafted transactions that cause the node to perform expensive verification operations, stalling worker threads and making the node unresponsive. This allows an attacker to disrupt the node's ability to process transactions and participate in the network.

Technologies: Zcash Foundation Zebra. Vendors: Zcash Foundation.

Quick answers

Is CVE-2026-104431 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-104431 being exploited in the wild.
How severe is CVE-2026-104431?: High severity, with a CVSS score of 7.5, published 2 October 2026.
Which products and versions are affected?: Zcash Foundation Zebra before 6.0.0.
Is there a fix for CVE-2026-104431?: Yes: fixed in Zebra 6.0.0. Until then: No configuration-only workaround is available; the per-peer download cap and verifier buffer width mitigate but do not prevent the attack. Upgrading to version 6.0.0 is required.</anigation> <parameter name="timeline">[{"kind":"disclosed","at":"2026-07-13"},{"kind":"advisory","at":"2026-10-02"}] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-104431 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-104431?: Check whether you run Zcash Foundation Zebra at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: Zebra 6.0.0

No configuration-only workaround is available; the per-peer download cap and verifier buffer width mitigate but do not prevent the attack. Upgrading to version 6.0.0 is required.</anigation> <parameter name="timeline">[{"kind":"disclosed","at":"2026-07-13"},{"kind":"advisory","at":"2026-10-02"}]

Technical details

The vulnerability occurs in the mempool transaction verifier, which performs expensive synchronous C++ FFI script verification (CachedFfiTransaction::is_valid()) before applying cheap standardness checks that would reject non-standard high-sigop P2SH transactions. Since the FFI call blocks the Tokio async worker thread and cannot be preempted, an unauthenticated peer can submit transactions that occupy the shared verifier buffer (width 5) and prevent honest transaction and block verification. A fix exists in version 6.0.0.

Affected products

Zcash Foundation Zebra before 6.0.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.