Skip to content

zebra-consensus

Follow this package

Get the evidence behind this dependency. Browse imported advisories below, or check an exact version against OSV now. View source coverage.

Check the version you ship.

Get a fresh OSV lookup for an exact release. We send the package name and version to OSV without storing a report.

Advisories & recorded fixes

high8.7
CVE-2026-123555

Zebra 2.3.0 before 7.0.0 Denial of Service via Unscored Script Verification Failures

Zebra from 2.3.0 before 7.0.0 contains a denial of service vulnerability that allows unauthenticated peers to evade misbehavior scoring by sending transactions or blocks with invalid transparent scripts. Attackers can flood mempool with script-failing transactions or serve forged v5 block bodies with altered scriptSig bytes to exhaust CPU and repeatedly stall block sync.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

ZcashFoundation · zebra / ZcashFoundation · zebra