Read the docs
TI-2026-66078 Aliases CVE-2026-104436GHSA-4m38-rccq-j8gv

Zebra before 4.5.0 CPU Amplification via Uncapped getblocks/getheaders Locator Length

Priority LOW 28CWE-770Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Attack requirements
Present
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · Low
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-770.

Summary

Zebra before 4.5.0 contains an uncontrolled resource consumption vulnerability that allows remote P2P peers to exhaust blocking-pool threads by sending oversized block locator vectors. Attackers can send getblocks or getheaders messages with up to 65,535 locator hashes, triggering per-hash chain lookups that degrade block validation, RPC, and mempool performance.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00273 19th percentileScored 2026-11-07
Fix Fixed zebra (ZcashFoundation): 4.5.0zebra-chain (ZcashFoundation): 8.0.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ZcashFoundationzebrabefore 4.5.04.5.0Patch availableCNA
ZcashFoundationzebra-chainbefore 8.0.08.0.0Patch availableCNA
  • zebra VendorZcashFoundation Affected before 4.5.0 Fixed in 4.5.0 Patch available CNA
  • zebra-chain VendorZcashFoundation Affected before 8.0.0 Fixed in 8.0.0 Patch available CNA

Remediation

  • Fix · CNA zebra (ZcashFoundation) Fixed in 4.5.0
  • Fix · CNA zebra-chain (ZcashFoundation) Fixed in 8.0.0

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    ZcashFoundation zebra 4.5.0

    2 records Highest priority Priority LOW 2 LOW

    Other records, highest priority first

    • TI-2026-66076 Zebra before 8.0.0 Denial of Service via z_listunifiedreceivers RPCPriority LOW 31
    Show all 2 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-104436
  2. 2026-10-03 Alias added: GHSA-4m38-rccq-j8gv
  3. 2026-10-29 Fix available: ZcashFoundation/[email protected] · CNA

References

Advisory 1

  • TI-2026-66079 Zebra before 4.4.0 Consensus Split via SIGHASH_SINGLE Missing-Output Handling CVSS 4.0HIGH 8.3
  • TI-2026-37850 ZEBRA: Mempool transaction admission denial via single-peer inbound queue saturation CVSS 3.1MEDIUM 5.3
  • TI-2026-71182 Improper block validation in Zebra gossip lets peers drop new blocks CVSS 4.0MEDIUM 6.3
  • TI-2026-29537 Zebra: addr/addrv2 Deserialization Resource Exhaustion CVSS 4.0MEDIUM 6.3
  • TI-2026-30136 ZEBRA: Consensus Divergence in Transparent Sighash Hash-Type Handling CVSS 4.0CRITICAL 9.3
  • TI-2026-37853 ZEBRA: Consensus divergence via P2SH sigop undercount in pure-Rust disabled-opcode parser CVSS 4.0CRITICAL 9.3
See all 44 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences