high7.5
CVE-2026-104431
Zebra before 6.0.0 contains a denial of service vulnerability that allows unauthenticated peers to stall Tokio workers by submitting mempool transactions requi…
Impact
Zebra before 6.0.0 contains a denial of service vulnerability that allows unauthenticated peers to stall Tokio workers by submitting mempool transactions requiring expensive synchronous script verification. Attackers can send non-standard high-sigop P2SH transactions that reach CachedFfiTransaction::is_valid() before standardness checks, saturating the verifier buffer and rendering the node unresponsive.
Affected products
| Product | Affected versions |
|---|---|
| Zebra | before 6.0.0 |
Versions were read from the advisory text. No structured product data has been published for this record yet.