CVE-2026-104431 — Zebra before 6.0.0 Denial of Service via Synchronous Script FFI Verification
Zebra before 6.0.0 contains a denial of service vulnerability that allows unauthenticated peers to stall Tokio workers by submitting mempool transactions requiring expensive syn…
Published: 2026-10-02 · CVSS: 8.7 · CVSS 4.0
Zebra before 6.0.0 contains a denial of service vulnerability that allows unauthenticated peers to stall Tokio workers by submitting mempool transactions requiring expensive synchronous script verification. Attackers can send non-standard high-sigop P2SH transactions that reach CachedFfiTransaction::is_valid() before standardness checks, saturating the verifier buffer and rendering the node unresponsive.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7