{"id":"CVE-2026-123555","aliases":[],"cve":{"records":[{"id":"CVE-2026-123555","source":"VulnCheck","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-11-06T00:50:45.482Z","published":"2026-11-08T01:37:57.593Z","modified":"2026-11-13T03:02:08.303Z"}],"publishers":[{"name":"VulnCheck","role":"CNA","organizationId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","modified":"2026-11-08T01:37:57.593Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-11-13T03:02:08.303Z"}],"references":[{"url":"https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-jq45-ghw5-v37x","tags":["vendor-advisory"],"source":"VulnCheck"},{"url":"https://github.com/ZcashFoundation/zebra/commit/e8db87eb69254e0d4eedd058eadd48bdfa09065a","tags":["patch"],"source":"VulnCheck"},{"url":"https://www.vulncheck.com/advisories/zebra-2.3.0-before-7.0.0-denial-of-service-via-unscored-script-verification-failures","tags":["third-party-advisory"],"source":"VulnCheck"}],"weaknesses":[{"id":"CWE-755","description":"Improper Handling of Exceptional Conditions","source":"VulnCheck"}],"applicability":[{"source":"VulnCheck","statements":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:zfnd:zebra:*:*:*:*:*:*:*:*","versionStartIncluding":"2.3.0","versionEndExcluding":"7.0.0"},{"vulnerable":true,"criteria":"cpe:2.3:a:zfnd:zebra:*:*:*:*:*:*:*:*","versionStartIncluding":"1.0.0-beta.46","versionEndExcluding":"18.0.0"}]}]}]}],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-11-13T03:01:56.391913Z","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"yes"},{"name":"Technical Impact","value":"partial"}]}]},"title":"Zebra 2.3.0 before 7.0.0 Denial of Service via Unscored Script Verification Failures","titleSource":"VulnCheck","descriptionSource":"VulnCheck","description":"Zebra from 2.3.0 before 7.0.0 contains a denial of service vulnerability that allows unauthenticated peers to evade misbehavior scoring by sending transactions or blocks with invalid transparent scripts. Attackers can flood mempool with script-failing transactions or serve forged v5 block bodies with altered scriptSig bytes to exhaust CPU and repeatedly stall block sync.","score":8.7,"severity":"high","published":"2026-11-08T01:37:57.593Z","modified":"2026-11-13T03:02:08.303Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"ZcashFoundation","name":"zebra","platforms":[],"versions":[{"version":"2.3.0","status":"affected","lessThan":"7.0.0","versionType":"semver"},{"version":"7.0.0","status":"unaffected","versionType":"semver"}],"defaultStatus":"unaffected","packageURL":"pkg:cargo/zebrad","packageIdentity":{"ecosystem":"crates.io","name":"zebrad"},"cpes":[],"source":"VulnCheck","url":"https://www.cve.org/CVERecord?id=CVE-2026-123555"},{"vendor":"ZcashFoundation","name":"zebra","platforms":[],"versions":[{"version":"1.0.0-beta.46","status":"affected","lessThan":"18.0.0","versionType":"semver"},{"version":"18.0.0","status":"unaffected","versionType":"semver"}],"defaultStatus":"unaffected","packageURL":"pkg:cargo/zebra-consensus","packageIdentity":{"ecosystem":"crates.io","name":"zebra-consensus"},"cpes":[],"source":"VulnCheck","url":"https://www.cve.org/CVERecord?id=CVE-2026-123555"}],"remediation":[],"references":["https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-jq45-ghw5-v37x","https://github.com/ZcashFoundation/zebra/commit/e8db87eb69254e0d4eedd058eadd48bdfa09065a","https://www.vulncheck.com/advisories/zebra-2.3.0-before-7.0.0-denial-of-service-via-unscored-script-verification-failures"],"sources":[{"name":"CVE","id":"CVE-2026-123555","modified":"2026-11-13T03:02:08.303Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-123555"}],"assessments":[{"source":"VulnCheck","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","score":8.7},{"source":"VulnCheck","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":7.5}],"sourceAffected":[],"observedAt":"2026-11-13T07:16:45.622Z","kev":{"status":"not-listed","checkedAt":"2026-11-15T00:55:33.128Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-11-08T03:06:00.863Z","attemptedAt":"2026-11-08T03:06:00.863Z"},{"source":"GHSA","status":"no-result","checkedAt":"2026-11-08T03:05:33.694Z","attemptedAt":"2026-11-08T03:05:33.694Z"},{"source":"EUVD","status":"available","checkedAt":"2026-11-08T03:05:34.271Z","attemptedAt":"2026-11-08T03:05:34.271Z"},{"source":"EPSS","status":"no-result","checkedAt":"2026-11-08T03:05:33.863Z","attemptedAt":"2026-11-08T03:05:33.863Z"}],"evidence":[{"source":"ENISA EUVD","id":"EUVD-2026-119440","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-119440","modified":"Nov 8, 2026, 1:37:57 AM","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","checkedAt":"2026-11-08T03:05:34.271Z"},{"source":"NVD","id":"CVE-2026-123555","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123555","modified":"2026-11-08T02:16:47.443","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","checkedAt":"2026-11-08T03:06:00.863Z"},{"source":"NVD","id":"CVE-2026-123555","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123555","modified":"2026-11-08T02:16:47.443","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","checkedAt":"2026-11-08T03:06:00.863Z"}],"aiSummary":{"text":"Zebra versions 2.3.0 before 7.0.0 and 1.0.0-beta.46 before 18.0.0 contain a denial of service vulnerability, allowing unauthenticated peers to evade misbehavior scoring. Attackers can flood the mempool or serve forged blocks to exhaust CPU and stall block sync. This is due to improper handling of exceptional conditions.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-11-08T02:21:16.690Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-123555"}]}}