Is CVE-2026-123555 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-123555 being exploited in the wild.

How severe is CVE-2026-123555?

High severity, with a CVSS score of 7.5, published 8 November 2026.

Which products and versions are affected?

Zcash Foundation Zebra 2.3.0 before 7.0.0; Zcash Foundation Zebra-Consensus 1.0.0-beta.46 before 18.0.0.

Is there a fix for CVE-2026-123555?

Yes: fixed in Zebra 7.0.0; zebra-consensus 18.0.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-123555 attacked?

It is attacked over the network.

Am I affected by CVE-2026-123555?

Check whether you run Zcash Foundation Zebra or Zcash Foundation Zebra-Consensus at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-123555: Zebra misbehavior scoring bypass via invalid script verification

CVE-2026-123555 · Severity: high · CVSS 7.5 · Published 2026-11-08

Zebra, a cryptocurrency node client, fails to penalize peers that relay invalid transactions or blocks, allowing attackers to flood the network with malicious data. An attacker can exhaust CPU resources and repeatedly stall the node's ability to sync blocks without being disconnected or rate-limited, leading to network disruption and denial of service.

Technologies: Zcash Foundation Zebra. Vendors: Zcash Foundation.

Quick answers

Is CVE-2026-123555 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-123555 being exploited in the wild.
How severe is CVE-2026-123555?: High severity, with a CVSS score of 7.5, published 8 November 2026.
Which products and versions are affected?: Zcash Foundation Zebra 2.3.0 before 7.0.0; Zcash Foundation Zebra-Consensus 1.0.0-beta.46 before 18.0.0.
Is there a fix for CVE-2026-123555?: Yes: fixed in Zebra 7.0.0; zebra-consensus 18.0.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-123555 attacked?: It is attacked over the network.
Am I affected by CVE-2026-123555?: Check whether you run Zcash Foundation Zebra or Zcash Foundation Zebra-Consensus at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: Zebra 7.0.0; zebra-consensus 18.0.0

Technical details

The vulnerability exists because transparent script verification failures are never converted to a misbehavior score in the transaction or block verification paths. When a peer relays a transaction with invalid scriptSig or serves a forged block body, the BoxError from the script verifier lacks a downcast arm in the TransactionError conversion and collapses to InternalDowncastError (score 0), bypassing peer penalty mechanisms. An unauthenticated attacker can repeatedly send script-failing transactions or block bodies to exhaust CPU and cause block-sync stalls without penalty.

Affected products

Zcash Foundation Zebra 2.3.0 before 7.0.0
Zcash Foundation zebra-consensus 1.0.0-beta.46 before 18.0.0

Timeline

2026-10-22: disclosed
2026: patched: Zebra 7.0.0 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.