# CVE-2026-104431: Zebra denial of service in mempool transaction verification

Source: https://junglewise.ai/threats/cve-2026-104431-zebra-before-6-0-0-contains-a-denial-of-service-vulnerability  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-02. Updated: 2026-10-05  
License: CC BY 4.0 with a link back

CVE-2026-104431 · Severity: high · CVSS 7.5 · Published 2026-10-02

Zebra is a Zcash cryptocurrency node implementation. A remote attacker can submit specially crafted transactions that cause the node to perform expensive verification operations, stalling worker threads and making the node unresponsive. This allows an attacker to disrupt the node's ability to process transactions and participate in the network.

Technologies: [Zcash Foundation Zebra](https://junglewise.ai/threats/technologies/zebra). Vendors: [Zcash Foundation](https://junglewise.ai/threats/vendors/zcash-foundation).

## Quick answers

**Is CVE-2026-104431 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-104431 being exploited in the wild.

**How severe is CVE-2026-104431?** High severity, with a CVSS score of 7.5, published 2 October 2026.

**Which products and versions are affected?** Zcash Foundation Zebra before 6.0.0.

**Is there a fix for CVE-2026-104431?** Yes: fixed in Zebra 6.0.0. Until then: No configuration-only workaround is available; the per-peer download cap and verifier buffer width mitigate but do not prevent the attack. Upgrading to version 6.0.0 is required.</anigation>
<parameter name="timeline">[{"kind":"disclosed","at":"2026-07-13"},{"kind":"advisory","at":"2026-10-02"}] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-104431 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-104431?** Check whether you run Zcash Foundation Zebra at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in Zebra 6.0.0

No configuration-only workaround is available; the per-peer download cap and verifier buffer width mitigate but do not prevent the attack. Upgrading to version 6.0.0 is required.</anigation>
<parameter name="timeline">[{"kind":"disclosed","at":"2026-07-13"},{"kind":"advisory","at":"2026-10-02"}]

## Technical details

The vulnerability occurs in the mempool transaction verifier, which performs expensive synchronous C++ FFI script verification (CachedFfiTransaction::is_valid()) before applying cheap standardness checks that would reject non-standard high-sigop P2SH transactions. Since the FFI call blocks the Tokio async worker thread and cannot be preempted, an unauthenticated peer can submit transactions that occupy the shared verifier buffer (width 5) and prevent honest transaction and block verification. A fix exists in version 6.0.0.

## Affected products

- Zcash Foundation Zebra before 6.0.0

## References

- [https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-84j3-rw4c-gqmj](https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-84j3-rw4c-gqmj)
- [https://www.vulncheck.com/advisories/zebra-before-6.0.0-denial-of-service-via-synchronous-script-ffi-verification](https://www.vulncheck.com/advisories/zebra-before-6.0.0-denial-of-service-via-synchronous-script-ffi-verification)

## Related threats

- [Zebra incomplete cleanup in checkpoint sync stalls initial sync](https://junglewise.ai/threats/cve-2026-123560-zebra-before-7-0-0-contains-an-incomplete-cleanup-vulnerability)
- [Zebra denial of service via quadratic sighash computation](https://junglewise.ai/threats/cve-2026-123559-zebra-before-7-0-0-contains-an-inefficient-algorithmic)
- [Zcash Foundation Zebra zebrad reachable assertion denial of service](https://junglewise.ai/threats/cve-2026-123557-zcashfoundation-zebra-zebrad-before-7-0-0-contains-a-reachable)
- [Zcash Foundation Zebra protection mechanism failure in mempool lock-time scoring](https://junglewise.ai/threats/cve-2026-123556-zcashfoundation-zebra-from-4-5-0-before-7-0-0-contains-a)
- [Zebra misbehavior scoring bypass via invalid script verification](https://junglewise.ai/threats/cve-2026-123555-zebra-from-2-3-0-before-7-0-0-contains-a-denial-of-service)