{"id":"CVE-2026-123559","aliases":[],"cve":{"records":[{"id":"CVE-2026-123559","source":"VulnCheck","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-11-06T00:50:45.483Z","published":"2026-11-08T01:38:00.337Z","modified":"2026-11-13T03:02:45.336Z"}],"publishers":[{"name":"VulnCheck","role":"CNA","organizationId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","modified":"2026-11-08T01:38:00.337Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-11-13T03:02:45.336Z"}],"references":[{"url":"https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-j4cw-58mj-7w6v","tags":["vendor-advisory"],"source":"VulnCheck"},{"url":"https://www.vulncheck.com/advisories/zebra-before-7.0.0-denial-of-service-via-quadratic-sighash-computation","tags":["third-party-advisory"],"source":"VulnCheck"}],"weaknesses":[{"id":"CWE-407","description":"Inefficient Algorithmic Complexity","source":"VulnCheck"}],"applicability":[{"source":"VulnCheck","statements":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:zfnd:zebra:*:*:*:*:*:*:*:*","versionEndExcluding":"7.0.0"}]}]}]}],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-11-13T03:02:36.579618Z","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"no"},{"name":"Technical Impact","value":"partial"}]}]},"title":"Zebra before 7.0.0 Denial of Service via Quadratic Sighash Computation","titleSource":"VulnCheck","descriptionSource":"VulnCheck","description":"Zebra before 7.0.0 contains an inefficient algorithmic complexity vulnerability that allows unauthenticated peers to exhaust verification threads by submitting transactions with many transparent inputs. Attackers can relay invalid transactions with tens of thousands of inputs, forcing quadratic ZIP-244 or ZIP-243 digest recomputation that stalls Rayon-backed block verification for minutes.","score":8.7,"severity":"high","published":"2026-11-08T01:38:00.337Z","modified":"2026-11-13T03:02:45.336Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"ZcashFoundation","name":"zebra","platforms":[],"versions":[{"version":"0","status":"affected","lessThan":"7.0.0","versionType":"semver"},{"version":"7.0.0","status":"unaffected","versionType":"semver"}],"defaultStatus":"unaffected","packageURL":"pkg:cargo/zebrad","packageIdentity":{"ecosystem":"crates.io","name":"zebrad"},"cpes":[],"source":"VulnCheck","url":"https://www.cve.org/CVERecord?id=CVE-2026-123559"}],"remediation":[],"references":["https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-j4cw-58mj-7w6v","https://www.vulncheck.com/advisories/zebra-before-7.0.0-denial-of-service-via-quadratic-sighash-computation"],"sources":[{"name":"CVE","id":"CVE-2026-123559","modified":"2026-11-13T03:02:45.336Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-123559"}],"assessments":[{"source":"VulnCheck","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","score":8.7},{"source":"VulnCheck","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":7.5}],"sourceAffected":[],"observedAt":"2026-11-13T07:16:47.185Z","kev":{"status":"not-listed","checkedAt":"2026-11-15T00:55:33.128Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-11-08T03:00:33.323Z","attemptedAt":"2026-11-08T03:00:33.323Z"},{"source":"GHSA","status":"no-result","checkedAt":"2026-11-08T03:00:32.962Z","attemptedAt":"2026-11-08T03:00:32.962Z"},{"source":"EUVD","status":"available","checkedAt":"2026-11-08T03:00:32.527Z","attemptedAt":"2026-11-08T03:00:32.527Z"},{"source":"EPSS","status":"no-result","checkedAt":"2026-11-08T03:00:32.340Z","attemptedAt":"2026-11-08T03:00:32.340Z"}],"evidence":[{"source":"ENISA EUVD","id":"EUVD-2026-119444","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-119444","modified":"Nov 8, 2026, 1:38:00 AM","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","checkedAt":"2026-11-08T03:00:32.527Z"},{"source":"NVD","id":"CVE-2026-123559","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123559","modified":"2026-11-08T02:16:48.177","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","checkedAt":"2026-11-08T03:00:33.323Z"},{"source":"NVD","id":"CVE-2026-123559","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123559","modified":"2026-11-08T02:16:48.177","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","checkedAt":"2026-11-08T03:00:33.323Z"}],"aiSummary":{"text":"Zebra before 7.0.0 has an inefficient algorithmic complexity vulnerability, allowing unauthenticated peers to cause a denial of service by submitting transactions with many inputs. This forces quadratic digest recomputation, stalling block verification. Attackers can relay invalid transactions with tens of thousands of inputs.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-11-08T02:16:37.240Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-123559"}]}}