CVE-2026-104425

Published: Ott 02, 2026 Last Modified: Ott 02, 2026
ExploitDB:
Other exploit source:
Google Dorks:
MEDIUM 6,9
Source: [email protected]
Attack Vector: network
Attack Complexity: low
Privileges Required: none
User Interaction: none
Confidentiality: N/A
Integrity: N/A
Availability: N/A
MEDIUM 5,3
Source: [email protected]
Attack Vector: network
Attack Complexity: low
Privileges Required: none
User Interaction: none
Scope: unchanged
Confidentiality: none
Integrity: none
Availability: low

Description

AI Translation Available

ZcashFoundation Zebra before 6.1.0 contains a resource exhaustion vulnerability that allows unauthenticated peers to degrade block processing by pushing transactions with invalid Orchard proofs without being misbehavior-scored. Attackers can repeatedly push invalid proofs into the shared halo2 batch verifier, forcing honest block proofs onto the slow individual-verification path and slowing block processing roughly sevenfold.

405

Asymmetric Resource Consumption (Amplification)

Incomplete
Abstraction: Class Structure: Simple
Common Consequences
Security Scopes Affected:
Availability
Potential Impacts:
Dos: Amplification Dos: Resource Consumption (Cpu) Dos: Resource Consumption (Memory) Dos: Resource Consumption (Other)
Applicable Platforms
Technologies: Not Technology-Specific, Client Server
View CWE Details
https://github.com/ZcashFoundation/zebra/security/advisorie…
https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-g7c4-2w6c-cr3r
https://www.vulncheck.com/advisories/zebra-before-6.1.0-bat…
https://www.vulncheck.com/advisories/zebra-before-6.1.0-batch-verification-pois…