CVE-2026-104423

Executive Summary

CVE-2026-104423 is an asymmetric resource-consumption (denial-of-service) vulnerability in the Zebra (zebrad) Zcash full node implementation before version 6.2.1. An unauthenticated network peer can submit V6 mempool transactions containing invalid (zero-filled) Halo2 proofs — specifically Orchard and Ironwood proofs — forcing nodes to expend disproportionate verification resources on a shared, unprioritized verification queue. The primary impact is availability: sustained flooding causes nodes to fall behind the chain tip, degrading consensus participation and network health for affected operators.

Technical Analysis

The vulnerability is rooted in CWE-405 — Asymmetric Resource Consumption (Amplification). The asymmetry lies in the cost differential between the attacker's action and the victim's response: a peer sends a small, zero-fee V6 transaction carrying a zero-filled Orchard and Ironwood Halo2 proof, while the receiving node must schedule and execute a full Halo2 proof-verification task to determine the proof is invalid. Because the Halo2 verification queue is described as shared and unprioritized, work submitted by an unauthenticated peer is not deprioritized relative to legitimate verification work, and invalid proofs are not cheaply rejected before consuming queue capacity.

Key mechanics per the NVD description:

• Attack surface: the P2P mempool transaction-intake path. Any connected peer can push V6 transactions.
• Trigger condition: submission of transactions with invalid Halo2 proofs (zero-filled Orchard and Ironwood proofs).
• Amplification vector: the shared, unprioritized Halo2 verification queue. Saturation of this queue delays valid proof verification.
• Economic asymmetry: transactions carry zero fees, so no fee-based rate limiting or cost penalty is imposed on the attacker at the transaction-intake stage.
• Security-control failure: there is no described mechanism to cheaply pre-validate or reject structurally invalid/zero-filled proofs prior to queue insertion, and no apparent priority separation between attacker-supplied and legitimate verification tasks.

The specific code paths, function names, or queue-management implementation details are not provided in the available intelligence, so they are not asserted here. The vulnerability class is a classic algorithmic-complexity / resource-exhaustion DoS where expansion ratio favors the attacker: minimal input, maximal victim work.

Exploitation Scenarios

No public PoC, exploit code, or Nuclei template is available; the attack chain below is inferred strictly from the vulnerability class and the NVD description.

1. Reconnaissance / target identification. The attacker identifies reachable zebrad nodes — for example via port 8233 (the default Zcash P2P port) or peers surfaced through the Zcash P2P address gossip protocol. No authentication or credentials are required (PR:N in the CVSS vector), so any node accepting inbound peer connections is a candidate.

2. Trigger of the specific flaw class (asymmetric resource consumption). The attacker establishes a peer connection and pushes V6 mempool transactions that contain Halo2 proofs which are structurally well-formed enough to enter the verification pipeline but cryptographically invalid — described as zero-filled Orchard and Ironwood proofs. Each such transaction forces the target to enqueue and execute proof-verification work.

3. Payload / execution method at the vulnerability-class level. The attacker floods many such zero-fee transactions. Because the transactions carry no fee, no fee-market disincentive throttles submission. Because the Halo2 verification queue is shared and unprioritized, the flood occupies queue capacity that would otherwise service legitimate verification. The attacker needs only modest bandwidth for many small transactions to impose large cumulative verification cost on the victim (amplification).

4. Post-exploitation impact. The node's verification queue saturates; valid proof verification is delayed and the node falls behind the chain tip. A node behind the tip cannot reliably follow consensus, may serve stale views to dependent services, and may effectively cease to be a useful consensus participant until the flood stops — a sustained availability impact (CVSS A:H). There is no described confidentiality or integrity impact (C:N/I:N), consistent with a pure DoS.

Impact Assessment

The CVSS v3.1 base score is 7.5 (High), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. Subscores indicate:

• Attack Vector: Network (AV:N) — exploitable remotely over P2P.
• Attack Complexity: Low (AC:L) — no special conditions or race required; just send the malformed transactions.
• Privileges Required: None (PR:N) — unauthenticated peers qualify.
• User Interaction: None (UI:N) — no operator action required to trigger.
• Scope: Unchanged (S:U) — impact confined to the vulnerable node.
• Confidentiality/Integrity: None (C:N/I:N) — no data exposure or tampering asserted.
• Availability: High (A:H) — the core impact; the node falls behind the chain tip.

Blast radius: individual Zcash full nodes running zebrad earlier than 6.2.1, and any services that depend on those nodes for chain-tip data (exchanges, wallets' backend infrastructure, block explorers, mining pools, and indexers). Downstream integrators that query a stalled node may see increased latency or stale-height responses. The impact scales with the number of nodes on a single operator's fleet and with the attacker's capacity to open connections to many nodes. There is no asserted confidentiality or integrity impact, so data-breach or tampering fallout is out of scope.

Detection Guidance

Sigma Rule

title: Zebrad Halo2 Verification Queue Flood via Invalid V6 Mempool Transactions (CVE-2026-104423)
id: 8f3c1a92-7b64-4e2d-9c11-0a5e6f3b2d10
status: experimental
description: Detects repeated rejection of V6 mempool transactions carrying invalid Halo2 proofs against a zebrad node, consistent with an asymmetric resource-consumption DoS attempt.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-104423
author: valtersit.com
date: 2026/01/01
tags:
  - attack.impact
  - attack.t1499
logsource:
  product: zebra
  service: zebrad
detection:
  selection:
    event.action|contains:
      - 'halo2'
      - 'proof'
      - 'verify'
    event.outcome: 'failure'
    network.transport: 'tcp'
  condition: selection | count() by source.ip > 25
  timeframe: 5m
fields:
  - source.ip
  - event.action
  - destination.port
falsepositives:
  - Legitimate peers submitting malformed transactions due to client bugs
  - Testnet / regtest traffic
level: medium

YARA Rule

rule CVE_2026_104423_Zebra_Invalid_Halo2_Flood
{
    meta:
        description = "Detects zebrad mempool/block ingest artifacts referencing invalid zero-filled Orchard/Ironwood Halo2 proof handling for CVE-2026-104423"
        author = "valtersit.com"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-104423"
        severity = "high"

    strings:
        $h2   = "halo2" ascii nocase
        $orch = "orchard" ascii nocase
        $iron = "ironwood" ascii nocase
        $v6   = "V6" ascii
        $memp = "mempool" ascii nocase
        $queue = "verification queue" ascii nocase
        $zero = "zero-filled" ascii nocase

    condition:
        uint32be(0) != 0x7f454c46 and
        filesize < 50MB and
        ($h2 and ($orch or $iron)) and
        ($v6 or $memp or $queue or $zero)
}

Suricata IDS Rule

alert tcp any any -> any 8233 (msg:"CVE-2026-104423 Zebra zebrad suspected V6 mempool flood with invalid Halo2 proofs (Orchard/Ironwood)"; flow:established,to_server; threshold:type both, track by_src, count 100, seconds 60; classtype:attempted-dos; reference:cve,CVE-2026-104423; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-104423; metadata:created_at 2026_01_01, updated_at 2026_01_01; sid:9000423; rev:1;)

Elastic Detection

// Detects a single source flooding a zebrad node with failed Halo2 proof verifications.
sequence by source.ip with maxspan=5m
  [ network where network.transport == "tcp" and destination.port == 8233 ]
  [ any where event.outcome == "failure" and event.action : "*halo2*" ]

// Threshold variant: many failed proof verifications from one peer.
any where event.action : "*halo2*" and event.outcome == "failure" and network.transport == "tcp"
| stats count() by source.ip, destination.port

Splunk SPL Query

index=zebra sourcetype=zebrad:log ("halo2" OR "proof" OR "verify") ("invalid" OR "failure" OR "reject")
| stats count as failures, dc(event_type) as distinct_event_types by src_ip, dest_port
| where failures > 25
| sort - failures
| table src_ip dest_port failures distinct_event_types

Wazuh OSSEC Rule

<group name="zebra,cve-2026-104423,">
  <rule id="100423" level="10">
    <decoded_as>json</decoded_as>
    <field name="service">zebrad</field>
    <match>halo2|Orchard|Ironwood|proof verification</match>
    <description>CVE-2026-104423: zebrad reported Halo2/Orchard/Ironwood proof verification failure - possible mempool flood DoS.</description>
  </rule>

  <rule id="100424" level="12" frequency="25" timeframe="300">
    <if_matched_sid>100423</if_matched_sid>
    <same_source_ip />
    <description>CVE-2026-104423: Possible zebrad asymmetric resource-consumption DoS from same source (flood of invalid Halo2 proofs).</description>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence is 0/4 — UNPATCHED. No patch evidence exists from any tracked source. Version 6.2.1 is described as the fixed release in the NVD description, but no vendor advisory or commit corroborates this. Treat all guidance as provisional.

1. Immediate mitigations (compensating controls):

   • Prioritize strict outbound/inbound peer controls: restrict P2P (default 8233) connectivity to known/trusted peers where operationally feasible, and apply per-peer connection and transaction-rate limits at the network edge.
   • Enable connection rate limiting and cap simultaneous inbound peers; identify and disconnect peers exhibiting high volumes of rejected mempool transactions.
   • Monitor node chain-tip lag and queue depth; alert on sustained divergence from tip height so operators can react before consensus participation degrades.
   • Where fee policy is configurable, consider policies that de-prioritize or refuse zero-fee transactions from unauthenticated peers — validate against current node documentation before deployment, as this may have side effects on legitimate traffic.
   • Apply IDS rules above to detect and triage inbound floods.

2. Patch / upgrade steps:

   • Upgrade zebrad to 6.2.1 or later once the vendor confirms availability; verify the release against the official Zebra project repository and signed release artifacts.
   • Because patch confidence is 0/4, do not assume 6.2.1 resolves the issue until a vendor advisory or release notes explicitly state so. Confirm the fix and any released CVE mapping.
   • After upgrade, re-test the P2P endpoint for the described behavior in a staging environment before production rollout.

3. Long-term hardening:

   • Segment public-facing nodes from internal indexers/wallets; deploy redundant, monitored nodes so a single stalled node does not cascade to downstream services.
   • Implement anomaly detection on per-peer transaction rejection and proof-verification failure rates, with automated peer ban (peer scoring) for abusive sources.
   • Participate in the upstream security process: track the Zebra project advisory feed and treat chain-tip lag as a first-class availability SLA metric.
   • Institute a change-control process that tracks CVE-to-release mapping so future unconfirmed fixes are independently validated.

References

• NVD — CVE-2026-104423: https://nvd.nist.gov/vuln/detail/CVE-2026-104423
• CWE-405 Asymmetric Resource Consumption (Amplification): https://cwe.mitre.org/data/definitions/405.html
• MITRE ATT&CK T1499 Endpoint Denial of Service: https://attack.mitre.org/techniques/T1499/
• Zebra (zebrad) project repository and release notes — verify the 6.2.1 release and any associated security advisory: https://github.com/ZcashFoundation/zebra
• CISA Known Exploited Vulnerabilities Catalog — confirmed NOT listed for CVE-2026-104423: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• No public PoC, exploit code, Nuclei template, OSV package entry, or known threat-actor campaign was identified in the provided intelligence; EPSS has not yet scored this CVE.