Is CVE-2026-123554 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-123554 being exploited in the wild.

How severe is CVE-2026-123554?

High severity, with a CVSS score of 7.5, published 8 November 2026.

Which products and versions are affected?

Zcash Foundation Zebrad 6.4.0 through 6.4.2 and 7.0.0-rc.0.

How is CVE-2026-123554 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-123554?

Check whether you run Zcash Foundation Zebrad at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-123554: Zcash zebrad quadratic work in mempool coinbase-maturity check

CVE-2026-123554 · Severity: high · CVSS 7.5 · Published 2026-11-08

Zebra is a full node implementation for the Zcash blockchain. A remote attacker connected to a Zebra node can send crafted transactions with many inputs and outputs to cause the node to spend tens of seconds verifying each transaction, consuming all available verification threads and halting block validation and peer synchronization. The node recovers when the attack stops.

Technologies: Zcash Foundation Zebrad. Vendors: Zcash Foundation.

Quick answers

Is CVE-2026-123554 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-123554 being exploited in the wild.
How severe is CVE-2026-123554?: High severity, with a CVSS score of 7.5, published 8 November 2026.
Which products and versions are affected?: Zcash Foundation Zebrad 6.4.0 through 6.4.2 and 7.0.0-rc.0.
Is there a fix for CVE-2026-123554?: Yes: fixed in zebrad 7.0.0. Until then: No workarounds are available; limiting inbound connections reduces exposure but does not eliminate it since any connected peer (inbound or outbound) can send the attack transaction. Upgrade to zebrad 7.0.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-123554 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-123554?: Check whether you run Zcash Foundation Zebrad at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: zebrad 7.0.0

No workarounds are available; limiting inbound connections reduces exposure but does not eliminate it since any connected peer (inbound or outbound) can send the attack transaction. Upgrade to zebrad 7.0.0.

Technical details

The mempool's coinbase-maturity check calls Transaction::coinbase_spend_restriction() once per spent outpoint; in affected versions, this call rebuilds and clones the transaction's entire output list, creating quadratic work (O(inputs × outputs)). Attackers can send unsigned transactions with many transparent inputs and outputs that fail standardness checks without incurring misbehavior penalties. The synchronous verification loop cannot be interrupted by the 73-second timeout.

Affected products

Zcash Foundation zebrad 6.4.0 through 6.4.2 and 7.0.0-rc.0

Timeline

2026-10-22: disclosed
2026-11-08: advisory
2026-10-15: patched: Fix committed in v7.0.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.