CVE-2026-104426 — Zebra before 6.1.0 Quadratic Complexity DoS via Block Transparent Value Check
Zebra before 6.1.0 contains an inefficient algorithmic complexity vulnerability in remaining_transaction_value that clones the entire block-level spent-UTXO map per transaction …
Published: 2026-10-02 · CVSS: 8.2 · CVSS 4.0
Zebra before 6.1.0 contains an inefficient algorithmic complexity vulnerability in remaining_transaction_value that clones the entire block-level spent-UTXO map per transaction during contextual verification. Attackers can mine or seed the mempool with roughly 26,000 minimal single-input transactions in one block, stalling every validating node for over 52 seconds.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7