Skip to content
Heist/ feed
Medium

Zebra before 4.5.0 CPU Amplification via Uncapped getblocks/getheaders Locator Length

Type: advisorySource: Official CVE ListRisk context updated1 source record

Zebra before 4.5.0 contains an uncontrolled resource consumption vulnerability that allows remote P2P peers to exhaust blocking-pool threads by sending oversized block locator vectors. Attackers can send getblocks or getheaders messages with up to 65,535 locator hashes, triggering per-hash chain lookups that degrade block validation, RPC, and mempool performance.

Announced Source revision 2
Original source ↗
CVE context updated. The publisher announcement is unchanged.

CVE-2026-104436

Primary source · Revision 2

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-104436

zebra

Source reference: /containers/cna/affected/0/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

zebra

Source reference: /containers/cna/affected/1/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "vendor": "ZcashFoundation",
    "product": "zebra",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "lessThan": "4.5.0",
        "versionType": "semver"
      },
      {
        "status": "unaffected",
        "version": "4.5.0",
        "versionType": "semver"
      }
    ],
    "packageURL": "pkg:cargo/zebrad",
    "defaultStatus": "unaffected"
  },
  {
    "vendor": "ZcashFoundation",
    "product": "zebra",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "lessThan": "8.0.0",
        "versionType": "semver"
      },
      {
        "status": "unaffected",
        "version": "8.0.0",
        "versionType": "semver"
      }
    ],
    "packageURL": "pkg:cargo/zebra-chain",
    "defaultStatus": "unaffected"
  }
]
Related CVEs
CVE-2026-104436

Source reference: /cveMetadata/cveId

Publisher severity

medium

Source reference: /containers/cna/metrics

Linked CVE context

These ratings describe the referenced vulnerabilities and products. They are not a severity rating for every application using this dependency.

CVE-2026-104436 · Low

zebrad, zebra-chain

Event
#72828 · Revision 2
Added to Heist Feed
Publisher date
Read the original announcement