CVE-2026-104424

Executive Summary

CVE-2026-104424 is an incorrect-calculation flaw (CWE-131) in the ZIP-317 block template selector of the Zebra cryptocurrency node software prior to version 6.1.0. The selector fails to account for header and transaction-count bytes in the block budget, allowing an attacker who can place valid selectable transactions into a victim miner's mempool to craft templates that exceed the real block size limit. The resulting oversized blocks are rejected by the network, wasting the victim miner's proof-of-work and degrading mining availability.

Technical Analysis

Zebra is an independent, Rust-based implementation of a Zcash full node. Version 6.1.0 is the first release that corrects the vulnerability. The flaw resides in the block template selection logic that implements ZIP-317, which is the proposed specification defining conventional fee structure and mempool behavior for Zcash.

Block template selection is the process whereby a mining node assembles a candidate block from mempool transactions, ordering them by fee policy and packing them into a size budget. A correct implementation must reserve space for two fixed, non-transaction components of every block:

1. The block header.
2. The transaction-count field, which encodes how many transactions are included.

The NVD description states that the ZIP-317 selector "omits header and transaction-count size from the block budget." In practical terms, the selector computes the available space for transactions as if the entire size limit were available to transactions alone. When the selector therefore fills that reduced-but-actually-oversized budget with transactions and serializes the finished block, the addition of the header and transaction count pushes the total serialized block beyond the network's maximum accepted size.

The vulnerability class is CWE-131 (Incorrect Calculation of Buffer Size). Critically, this is an off-by-header accounting error — not a memory-safety buffer overflow. The relevant "buffer" is the protocol-defined block size budget, and the miscalculation is a logical sizing error. The block is not truncated unsafely; rather, it is assembled at an invalid size and then discarded by validating peers.

The bug is triggerable by a remote party that can influence mempool contents. The CVSS vector (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L) reflects network attack surface, high attack complexity (the attacker must land transactions in the right place at the right time and shape selection), no privileges, no user interaction, and a low availability-only impact. There is no confidentiality or integrity impact: the attacker cannot read data or alter ledger state, only cause the victim's mining work to be rejected.

Because ZIP-317 governs fee-based transaction selection, an attacker with valid, fee-paying transactions in the victim's mempool can influence which transactions the selector picks and how they pack. By supplying a set of "valid selectable transactions" sized to fill the over-large budget, the attacker reliably drives template construction past the legitimate limit.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the vulnerability class and the NVD description. Only the components and behaviors named in the description are asserted; no additional function names, endpoints, or code paths are invented.

1. Reconnaissance and target identification. The attacker identifies miner nodes running vulnerable Zebra versions (< 6.1.0). Because mempool propagation is a normal peer-to-peer function, the attacker does not need to compromise the target directly — it need only be peered with, or able to relay transactions to, the victim miner.

2. Triggering the flaw class. The attacker authorizes and broadcasts a set of valid, fee-paying transactions (ZIP-317 "selectable" transactions) that relay into the victim miner's mempool. Because the victim's ZIP-317 block template selector omits the header and transaction-count size from its size budget, the selector accepts into the template a transaction set whose combined serialized size, once these two non-transaction components are appended, exceeds the network's maximum block size.

3. Payload/execution method at the vulnerability-class level. This is an incorrect-calculation (sizing) attack, not a code-injection attack. There is no memory-corruption payload. The "payload" is simply the crafted set of valid transactions that steers the miscalculated budget to its limit. The attacker's goal is to make the produced block deterministically oversized.

4. Post-exploitation impact. The victim miner assembles the oversized block and applies proof-of-work to it. When the block is propagated, validating peers reject it for exceeding the maximum block size. The miner's proof-of-work for that template is wasted — the block cannot be accepted and the associated block reward is foregone for that attempt. Repeated shaping can cause recurring waste and degraded effective hash efficiency, though the CVSS score (3.7, availability-only, low) reflects limited, non-persistent impact rather than a full denial of service.

Impact Assessment

CVSS 3.1 base score 3.7 (Low). Subscores: AV:N (remotely reachable via peer-to-peer/mempool propagation), AC:H (requires the attacker to shape mempool contents such that selection produces an oversized template), PR:N (no credentials required), UI:N (no interaction from the miner operator), S:U (impact remains within the Zebra node's security scope), C:N and I:N (no confidentiality or integrity impact — the ledger and node data are not read or modified), A:L (low availability impact — wasted mining effort and rejected blocks rather than an unrecoverable outage).

Affected systems are Zebra full nodes that perform block template construction for mining, at versions earlier than 6.1.0. Blast radius is bounded to the availability of the mining function for those nodes; non-mining nodes and the broader Zcash network are not directly impacted by the flaw itself.

Business impact centers on mining economics and operational reliability: a miner running vulnerable Zebra can have proof-of-work repeatedly invalidated, reducing realized hash efficiency and revenue for the duration of the campaign. Because C and I are None, there is no data-breach or data-tampering exposure to report. The EPSS score is not yet published by FIRST.org, and there is no evidence of exploitation in the wild or inclusion in CISA KEV.

Detection Guidance

Sigma Rule

title: Zebra ZIP-317 Oversized Block Template Construction (CVE-2026-104424)
id: 8f3c1d2e-4a5b-4c6d-9e7f-0a1b2c3d4e5f
status: experimental
description: Detects Zebra miner nodes producing blocks that exceed the maximum size limit due to the ZIP-317 block template selector omitting header and transaction-count size from the block budget.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-104424
author: valtersit.com
date: 2026/01/01
logsource:
  product: zebra
  service: miner
detection:
  selection:
    event:
      - 'block_template_created'
      - 'block_rejected'
      - 'block_size_exceeded'
  filter_vuln:
    zebra_version|lt: '6.1.0'
  condition: selection and filter_vuln
falsepositives:
  - Legitimate large-template construction on correctly patched nodes
level: low
tags:
  - attack.t1499
  - cve.2026.104424

YARA Rule

rule CVE_2026_104424_Zebra_ZIP317_Oversized_Template
{
    meta:
        description = "Detects Zebra binaries/telemetry referencing ZIP-317 block template selection prior to fixed 6.1.0 build"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-104424"
        date = "2026-01-01"
        cve = "CVE-2026-104424"
    strings:
        $s1 = "ZIP-317" ascii nocase
        $s2 = "block template" ascii nocase
        $s3 = "block budget" ascii nocase
        $s4 = "transaction-count" ascii nocase
        $ver = "6.1.0" ascii
    condition:
        uint16(0) == 0x5A4D or (($s1 or $s2 or $s3) and not $ver)
}

Suricata IDS Rule

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"CVE-2026-104424 Zebra ZIP-317 oversized block template shaping attempt (mempool transaction flood)"; flow:established,to_server; dsize:>1000; threshold: type both, track by_src, count 50, seconds 60; classtype:attempted-dos; sid:2026104424; rev:1; metadata:cve CVE-2026-104424, vendor Zebra;)

Elastic Detection

sequence by process.entity_id with maxspan=2m
  [process where event.action == "start" and process.name == "zebra"]
  [process where event.action == "block_template_created" and process.name == "zebra" and process.args : "*zip317*" and not process.args : "*6.1.0*"]
  [any where event.action == "block_rejected" and process.name == "zebra"]

Splunk SPL Query

index=zebra sourcetype=zebra:node (event="block_template_created" OR event="block_rejected" OR event="block_size_exceeded")
| eval vuln=if(zebra_version < "6.1.0", 1, 0)
| where vuln=1
| stats count min(_time) as firstTime max(_time) as lastTime by host, event, zebra_version
| sort - count

Wazuh OSSEC Rule

<group name="zebra,cve-2026-104424,">
  <rule id="104424" level="5">
    <decoded_as>json</decoded_as>
    <field name="event">block_template_created|block_rejected|block_size_exceeded</field>
    <regex>ZIP-317|block budget|block template</regex>
    <description>CVE-2026-104424: Zebra ZIP-317 block template selector produced an oversized block (possible mining DoS shaping).</description>
  </rule>
  <rule id="104425" level="10">
    <if_sid>104424</if_sid>
    <field name="zebra_version">^([0-5]\.|6\.0\.)</field>
    <description>CVE-2026-104424: Vulnerable Zebra version (&lt; 6.1.0) observed generating oversized block templates.</description>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations:

   • The only stated fix is upgrading Zebra to 6.1.0 or later; no workaround is documented in the provided data, and none should be assumed.
   • Restrict or monitor the miner node's peer connections and transaction relay to reduce the ability of untrusted peers to place shaping transactions in the mempool.
   • Where feasible, isolate mining nodes from untrusted mempool flood sources and alert on repeated block rejection events, which may indicate shaping.

2. Patch/upgrade steps:

   • Verify the running node version. If it is earlier than 6.1.0, upgrade to 6.1.0 or a later release, which contains the corrected ZIP-317 block template selector accounting for header and transaction-count size.
   • Because patch confidence is 0/4 with no tracked vendor patch source in this dataset, operators should independently confirm the fix release and its integrity against official Zebra project channels before deployment.

3. Long-term hardening:

   • Track upstream Zebra security advisories and adopt a routine version-audit process for all mining nodes.
   • Add monitoring and alerting on block-template size versus the protocol maximum, and on block-rejection spikes, as a durable detection control for sizing-class template bugs.
   • Treat block-construction accounting logic (size budgets, reserved fields) as security-relevant code and require regression tests that include header and transaction-count overhead.

References

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-104424
• CWE-131 Incorrect Calculation of Buffer Size: https://cwe.mitre.org/data/definitions/131.html
• ZIP-317 (Conventional Fee Structure and Mempool Behavior for Zcash): https://zips.z.cash/zip-0317
• MITRE ATT&CK T1499 Endpoint Denial of Service: https://attack.mitre.org/techniques/T1499/
• CISA KEV Catalog (no entry for CVE-2026-104424 as of this report): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No threat actor campaigns or exploit-in-the-wild evidence are associated with CVE-2026-104424 in the available data. No public PoC, exploit code, or Nuclei template was identified, and the vulnerability was not listed in CISA KEV.