CVE-2026-104424

LOWCVSS 3.7

Description

Zebra before 6.1.0 contains an incorrect calculation vulnerability in its ZIP-317 block template selector that omits header and transaction-count size from the block budget. Attackers can place valid selectable transactions in a victim miner's mempool to shape templates into oversized blocks, causing rejection and wasted proof-of-work.

Timeline

Published:October 2nd, 2026 12:17 PM

Last modified:October 6th, 2026 3:17 AM

CVSS Scoring

CVSS v3: 3.7 (LOW)

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

Weaknesses (CWE)

CWE-131

References & Reports

Advisories, patches, and third-party reports

https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-95m2-vx53-v2jw
https://www.vulncheck.com/advisories/zebra-before-6.1.0-incorrect-block-size-calculation-in-getblocktemplate

Source: NIST NVD · Data may lag official sources by up to one minute