---
id: CVE-2026-123559
title: Zebra before 7.0.0 Denial of Service via Quadratic Sighash Computation
summary: >-
  Zebra before 7.0.0 contains an inefficient algorithmic complexity
  vulnerability that allows unauthenticated peers to exhaust verification
  threads by submitting transactions with many transparent inputs. Attackers can
  relay invalid transa…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
cvssSource: cna
cwe:
  - CWE-407
vendor: ZcashFoundation
product: zebra
affected:
  - zebra < 7.0.0
published: '2026-11-08'
updated: '2026-11-08'
sourceUpdated: '2026-11-08T01:38:00.337Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-123559'
references:
  - url: >-
      https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-j4cw-58mj-7w6v
    label: GitHub Security Advisory (GHSA-j4cw-58mj-7w6v)
  - url: >-
      https://www.vulncheck.com/advisories/zebra-before-7.0.0-denial-of-service-via-quadratic-sighash-computation
    label: >-
      VulnCheck Advisory: Zebra before 7.0.0 Denial of Service via Quadratic
      Sighash Computation
tags:
  - cve.org
ingestedAt: '2026-11-08T02:43:18.663Z'
---

## Overview

Zebra before 7.0.0 contains an inefficient algorithmic complexity vulnerability that allows unauthenticated peers to exhaust verification threads by submitting transactions with many transparent inputs. Attackers can relay invalid transactions with tens of thousands of inputs, forcing quadratic ZIP-244 or ZIP-243 digest recomputation that stalls Rayon-backed block verification for minutes.

## Affected

- `zebra < 7.0.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.