CVE-2026-104431
Zebra before 6.0.0 contains a denial of service vulnerability that allows unauthenticated peers to stall Tokio workers by submitting mempool transactions requiring expensive synchronous script verification. Attackers can send non-standard high-sigop P2SH transactions that reach CachedFfiTransaction::is_valid() before standardness checks, saturating the verifier buffer and rendering the node unresponsive.
- Published Oct 2, 2026
- CVSS 8.7 high
- 0.3% chance of exploitation in the next 30 days (EPSS)
- A fix is available