CVE-2026-104425
Executive Summary
CVE-2026-104425 is a resource exhaustion vulnerability in the ZcashFoundation Zebra node implementation prior to version 6.1.0. Unauthenticated network peers can submit transactions containing invalid Orchard proofs that are not penalized by the misbehavior scoring system, causing the shared halo2 batch verifier to become congested. This forces legitimate block proofs onto a slow individual-verification path, degrading block processing throughput by approximately sevenfold. The impact is limited to availability (CVSS 5.3, A:L), with no confidentiality or integrity effects, but it can significantly reduce network node performance and potentially aid chain-tip lag or eclipse-style degradation in constrained environments.
This record — and 170,000+ others — are available via the ValtersIT API. One endpoint replaces five: NVD + GitHub CVE + CISA KEV + EPSS + Nuclei + Exploit-DB, unified.
No signup required
Technical Analysis
Zebra is a Zcash full node implementation written in Rust. The vulnerability resides in the interaction between transaction validation, the shared halo2 batch verifier, and the misbehavior-scoring subsystem.
The NVD description states that unauthenticated peers can push transactions with invalid Orchard proofs "without being misbehavior-scored." In Zebra's design, peers that send invalid data are normally penalized via a misbehavior score that can lead to disconnection or banning. Here, the invalid Orchard proofs are apparently accepted into the shared halo2 batch verifier queue without triggering that penalty. Because the verifier is shared, the accumulation of invalid proof items consumes batch-verification capacity. When honest block proofs arrive, the verifier cannot efficiently batch them together with the polluted queue, so those proofs fall back to individual verification. Individual verification is dramatically slower than batch verification, producing the "roughly sevenfold" slowdown in block processing.
The attack surface is the peer-to-peer network interface. Any unauthenticated peer capable of sending transactions to a Zebra node can attempt this. The flaw class is CWE-405 (Asymmetric Resource Consumption / Amplification), where a small amount of attacker input causes disproportionate resource consumption on the target.
At the code level, the description implies that the logic separating batch verification of transaction proofs from block proofs, and the logic that maps verification failures to misbehavior scores, does not treat invalid Orchard proofs as a scoring event. No specific function names, parameter names, or file paths are provided in the NVD description, so those details are not asserted here beyond the named components: Zebra, Orchard proofs, and the halo2 batch verifier.
Exploitation Scenarios
No public proof-of-concept or exploit code is available; the attack chain below is inferred at the vulnerability-class level from the NVD description.
Reconnaissance/target identification: An attacker identifies reachable Zebra nodes running versions before 6.1.0, typically via the Zcash peer-to-peer network or by scanning for Zebra nodes (default P2P port 8233). No authentication is required.
Triggering the flaw: The attacker connects as a peer and sends transactions containing invalid Orchard proofs. Because these invalid proofs are not misbehavior-scored, the peer is not disconnected or banned, and the crafted proof data is admitted into the shared halo2 batch verifier.
Payload/execution method: The attacker repeats the submission of invalid Orchard proofs, filling the batch verifier with low-value work. This is a resource-exhaustion pattern rather than memory corruption or code execution. The attacker does not need a valid Orchard proof; the invalidity is the point, because invalid entries still occupy verification capacity.
Post-exploitation impact: With the batch verifier congested, honest block proofs shift to the slow individual-verification path, slowing block processing roughly sevenfold. The node continues to operate but lags behind the chain tip, which can reduce its usefulness and, in aggregate, degrade network propagation if enough nodes are affected.
Impact Assessment
The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L, giving a base score of 5.3 (Medium). Network attack vector and low attack complexity mean the barrier to attempt is low; no privileges or user interaction are required. The scope is unchanged (S:U), and there are no confidentiality or integrity impacts. The availability impact is Low (A:L), which understates the practical effect described: a sevenfold slowdown in block processing can push a node behind the chain tip and reduce its service quality.
Business impact is primarily operational for node operators, exchanges, custodians, and infrastructure providers running Zebra for Zcash. A degraded node may fall behind, fail to relay timely blocks, or cause downstream services to see stale chain data. Blast radius depends on topology: individual nodes are affected independently, but a coordinated multi-peer attack against a set of nodes could degrade a portion of the network. There is no data theft or fund-loss vector described.
Detection Guidance
Sigma Rule
title: Zebra Invalid Orchard Proof Resource Exhaustion Attempt
id: 8f2c1a44-7b1e-4c2a-9d3f-0a1b2c3d4e5f
status: experimental
description: Detects log patterns indicating repeated invalid Orchard proof submissions not resulting in peer misbehavior penalties, consistent with CVE-2026-104425 against Zebra before 6.1.0.
references:
- https://nvd.nist.gov/vuln/detail/CVE-2026-104425
author: valtersit.com
date: 2026/01/01
logsource:
product: zebra
service: node
detection:
keywords:
- "invalid orchard proof"
- "halo2 batch verifier"
- "verification failed"
- "individual verification"
condition: keywords
falsepositives:
- Legitimate invalid transactions from buggy wallets
- Debug logging during development
level: medium
tags:
- attack.t1499
- cwe.405
YARA Rule
rule CVE_2026_104425_Zebra_Invalid_Orchard_Proof
{
meta:
description = "Detects Zebra log/artifact strings related to invalid Orchard proof resource exhaustion (CVE-2026-104425)"
author = "valtersit.com"
date = "2026-01-01"
reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-104425"
severity = "medium"
strings:
$s1 = "invalid orchard proof" ascii nocase
$s2 = "halo2 batch verifier" ascii nocase
$s3 = "individual verification" ascii nocase
$s4 = "6.1.0" ascii
condition:
any of ($s1, $s2, $s3)
}
Suricata IDS Rule
alert tcp any any -> any 8233 (msg:"CVE-2026-104425 Zebra invalid Orchard proof resource exhaustion attempt"; flow:established,to_server; dsize:>200; threshold:type both, track by_src, count 50, seconds 60; classtype:attempted-dos; reference:cve,2026-104425; sid:2026104425; rev:1;)
Elastic Detection
sequence by source.ip with maxspan=60s
[network where destination.port == 8233 and network.transport == "tcp"]
[network where destination.port == 8233 and network.transport == "tcp"]
Splunk SPL Query
index=zebra sourcetype=zebra:node ("invalid orchard proof" OR "verification failed" OR "individual verification")
| stats count by src_ip, host
| where count > 20
| sort - count
Wazuh OSSEC Rule
<group name="zebra,">
<rule id="100425" level="7">
<decoded_as>json</decoded_as>
<match>invalid orchard proof|halo2 batch verifier|individual verification</match>
<description>CVE-2026-104425 - Possible Zebra invalid Orchard proof resource exhaustion attempt</description>
<mitre>
<id>T1499</id>
</mitre>
<group>cve_2026_104425,availability,</group>
</rule>
</group>
Mitigation & Patch Guidance
Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).
Immediate mitigations:
- Restrict peer connections to trusted peers where feasible, reducing exposure to unauthenticated peer traffic.
- Monitor node logs for repeated invalid Orchard proof events and correlate with peer identities.
- Apply connection rate limiting and peer banning policies at the network layer, recognizing that the misbehavior scoring described does not currently penalize this behavior.
- Ensure nodes are not operated in configurations that allow excessive inbound peer transactions from untrusted sources.
Patch/upgrade steps:
- Upgrade Zebra to version 6.1.0 or later, which the NVD description identifies as containing the fix. Because patch confidence is low and no vendor advisory or patch source is tracked, verify the fix against the official Zcash Foundation repository and release notes before relying on it.
- Follow the project's release channel for confirmation and any hotfix versions.
Long-term hardening:
- Track upstream changes to Zebra's halo2 batch verifier and misbehavior-scoring logic.
- Enforce peer diversity and reputation controls at the node and network layers.
- Deploy resource monitoring and alerting on block-processing latency to detect multi-fold slowdowns early.
References
- NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-104425
- Zcash Foundation Zebra repository and release notes (Zebra 6.1.0): https://github.com/ZcashFoundation/zebra
- CWE-405 — Asymmetric Resource Consumption (Amplification): https://cwe.mitre.org/data/definitions/405.html
- MITRE ATT&CK T1499 — Endpoint Denial of Service: https://attack.mitre.org/techniques/T1499/
- CISA KEV Catalog: not applicable (CVE-2026-104425 is not listed as of this report)
What is this? Security researchers use these exact search queries on Shodan.io (a search engine for internet-connected devices) to find vulnerable systems globally. You can copy these dorks to see if your organization's IP space is exposed.