# CVE-2026-123554: Zcash zebrad quadratic work in mempool coinbase-maturity check

Source: https://junglewise.ai/threats/cve-2026-123554-zebra-zebrad-6-4-0-before-7-0-0-performs-quadratic-work-in-the  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-08. Updated: 2026-11-08  
License: CC BY 4.0 with a link back

CVE-2026-123554 · Severity: high · CVSS 7.5 · Published 2026-11-08

Zebra is a full node implementation for the Zcash blockchain. A remote attacker connected to a Zebra node can send crafted transactions with many inputs and outputs to cause the node to spend tens of seconds verifying each transaction, consuming all available verification threads and halting block validation and peer synchronization. The node recovers when the attack stops.

Technologies: [Zcash Foundation Zebrad](https://junglewise.ai/threats/technologies/zcash-foundation-zebrad). Vendors: [Zcash Foundation](https://junglewise.ai/threats/vendors/zcash-foundation).

## Quick answers

**Is CVE-2026-123554 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-123554 being exploited in the wild.

**How severe is CVE-2026-123554?** High severity, with a CVSS score of 7.5, published 8 November 2026.

**Which products and versions are affected?** Zcash Foundation Zebrad 6.4.0 through 6.4.2 and 7.0.0-rc.0.

**Is there a fix for CVE-2026-123554?** Yes: fixed in zebrad 7.0.0. Until then: No workarounds are available; limiting inbound connections reduces exposure but does not eliminate it since any connected peer (inbound or outbound) can send the attack transaction. Upgrade to zebrad 7.0.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-123554 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-123554?** Check whether you run Zcash Foundation Zebrad at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in zebrad 7.0.0

No workarounds are available; limiting inbound connections reduces exposure but does not eliminate it since any connected peer (inbound or outbound) can send the attack transaction. Upgrade to zebrad 7.0.0.

## Technical details

The mempool's coinbase-maturity check calls Transaction::coinbase_spend_restriction() once per spent outpoint; in affected versions, this call rebuilds and clones the transaction's entire output list, creating quadratic work (O(inputs × outputs)). Attackers can send unsigned transactions with many transparent inputs and outputs that fail standardness checks without incurring misbehavior penalties. The synchronous verification loop cannot be interrupted by the 73-second timeout.

## Affected products

- Zcash Foundation zebrad 6.4.0 through 6.4.2 and 7.0.0-rc.0

## Timeline

- 2026-10-22: disclosed
- 2026-11-08: advisory
- 2026-10-15: patched: Fix committed in v7.0.0

## References

- [https://github.com/ZcashFoundation/zebra/commit/08743d669b33a19bce2a5d54001bd468c03a196e](https://github.com/ZcashFoundation/zebra/commit/08743d669b33a19bce2a5d54001bd468c03a196e)
- [https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-7jp4-mq53-4cvq](https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-7jp4-mq53-4cvq)

## Related threats

- [Zebra zebrad denial of service in checkpoint sync verification](https://junglewise.ai/threats/cve-2026-123558-zebra-zebrad-before-7-0-0-contains-a-denial-of-service)
- [Zebra consensus rule enforcement bypass in V5 SIGHASH_SINGLE](https://junglewise.ai/threats/cve-2026-104435-zebra-zebrad-4-4-0-and-zebra-script-6-0-0-fail-to-enforce-a-zip)
- [Zcash Foundation Zebra reachable assertion in z_listunifiedreceivers RPC handler](https://junglewise.ai/threats/cve-2026-104434-zcashfoundation-zebra-zebra-rpc-before-8-0-0-and-zebrad-before-4)
- [Zebra P2SH sigop counting consensus divergence](https://junglewise.ai/threats/cve-2026-104430-zebra-zebrad-4-5-0-and-zebra-script-7-0-0-count-p2sh-redeem)