CVE-2026-104426

Executive Summary

CVE-2026-104426 is an algorithmic complexity (inefficient algorithm) vulnerability in Zebra versions before 6.1.0, specifically in the remaining_transaction_value routine used during contextual block verification. An attacker able to submit transactions to the network or mempool can craft roughly 26,000 minimal single-input transactions within a single block, causing validating nodes to clone a full block-level spent-UTXO map per transaction and stall for over 52 seconds. With a CVSS 3.1 base score of 5.9 (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H), the flaw is a remote, unauthenticated denial-of-service condition with high availability impact and no confidentiality or integrity impact. No public PoC, exploit code, or Nuclei template is available, and the vendor has not published a verified fix through tracked channels; the NVD description references version 6.1.0 as the resolution boundary.

Technical Analysis

The vulnerability class is CWE-407 (Inefficient Algorithmic Complexity), which manifests when an algorithm's runtime or resource consumption grows disproportionately with input volume, enabling an attacker to force excessive computation using carefully sized inputs. In this case, the NVD description states that the remaining_transaction_value function clones the entire block-level spent-UTXO map per transaction during contextual verification. This is a classic quadratic (or worse) blow-up: if each of N transactions in a block triggers a full copy of a map whose size also scales with N, the aggregate work becomes approximately O(N²) in map-copy operations. The spent-UTXO set is a core state structure tracking which unspent transaction outputs have already been consumed within the verification context; copying it repeatedly is inherently memory- and CPU-intensive.

The attack surface is the transaction/block ingestion and contextual verification path of a Zebra node. remaining_transaction_value is invoked during contextual verification — the phase in which a node checks a transaction or block against the current chain state (including spent outputs) rather than validating it statelessly. Because contextual verification runs on every validating node that receives the block, any node participating in consensus and transaction relay is exposed. The attacker does not need special privileges: the transactions are ordinary, minimal single-input transactions that satisfy the validity rules for size and structure; the abuse is purely volumetric and structural, not malformed.

The NVD description quantifies the impact precisely: mining or seeding the mempool with roughly 26,000 minimal single-input transactions in one block stalls every validating node for over 52 seconds. The use of "minimal single-input" transactions matters because it maximizes the number of distinct transactions (and thus the number of map clonings) for a given block size budget, while keeping each transaction individually cheap to construct. The "block-level" qualifier on the spent-UTXO map indicates the map is scoped to the set of spends being processed for the block, so scaling the transaction count directly scales both the map size and the number of clones. Note that the vendor and product are listed as Unknown/Unknown in the supplied metadata, but the CNA title and NVD description identify the component as Zebra prior to 6.1.0; no CPE or OSV package mapping was provided. No specific function signatures, file paths, or parameter names beyond remaining_transaction_value are available, so the code-level analysis above is limited to the mechanism described in the NVD text.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the vulnerability class and the NVD description.

1. Reconnaissance / target identification: The attacker identifies Zebra nodes running a version prior to 6.1.0. Because Zebra is a network-facing node implementation, exposure is determined by whether the adversary can deliver transactions and blocks to the node, either by participating in the peer-to-peer network that propagates transactions and blocks or by directly connecting to exposed node interfaces. The Shodan dorks in the metadata support locating internet-reachable Zebra services.

2. Triggering the flaw class: The attacker constructs roughly 26,000 minimal single-input transactions. "Minimal single-input" means each transaction consumes a single unspent output, keeping the transaction small and the per-transaction construction cost low while maximizing the number of transactions that can be packed into one block. These are validly formed transactions; no memory-corruption or malformed-input primitive is used. The abuse is algorithmic, not structural.

3. Delivery / execution method: The attacker either mines a block containing these transactions or seeds the mempool so that a block containing them is produced. When a validating node performs contextual verification of that block, remaining_transaction_value is executed once per transaction and clones the entire block-level spent-UTXO map on each invocation. With ~26,000 transactions, the accumulated map-copy work drives verification time past 52 seconds. Because every validating node that processes the block repeats the same computation, the effect is replicated network-wide rather than confined to a single victim.

4. Post-exploitation impact: The result is a denial-of-service condition. Validating nodes are computationally stalled for the duration of the blow-up, delaying block processing and transaction confirmation and creating an availability failure with no confidentiality or integrity impact (consistent with C:N/I:N/A:H). Repeated or sustained abuse could keep nodes persistently behind the chain tip, amplifying mempool pressure and degrading overall network throughput. No privilege escalation, data exposure, or code execution is described.

Impact Assessment

The CVSS 3.1 vector is CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H, base score 5.9 (Medium). Subscore interpretation:

• Attack Vector (AV:N): the flaw is reachable over the network — an attacker capable of delivering transactions/blocks to a node can trigger it remotely.
• Attack Complexity (AC:H): exploitation requires crafting a large, carefully sized set of transactions and getting them into a block or mempool, which is non-trivial and partially dependent on network/block-production conditions. This reflects that the attacker must control or influence block/mempool composition rather than simply send a single packet.
• Privileges Required (PR:N) and User Interaction (UI:N): no account, credential, or victim action is needed; the node processes the block autonomously as part of normal operation.
• Scope (S:U): the impact does not cross trust/security boundaries beyond the node component being stressed.
• Confidentiality (C:N) and Integrity (I:N): no data disclosure or data tampering is described.
• Availability (A:H): the primary and severe impact — validating nodes stall for over 52 seconds per crafted block, and every validating node is affected.

Business impact: organizations operating Zebra nodes (exchanges, custodians, payment processors, mining/validator operations, and infrastructure providers) face degraded or interrupted transaction processing, delayed confirmation, and potential inability to stay in sync with the chain. Blast radius is broad because the stall applies to all validating nodes processing the block, not just the target; any node that performs contextual verification of the crafted block is affected. The EPSS score is not yet assigned by FIRST.org, so no exploitation-likelihood weighting is available. CISA KEV status is NO, indicating no confirmed in-the-wild exploitation at this time. Patch confidence is 0/4 (UNPATCHED — no patch evidence from any tracked source); no affected-version list, workaround, or vendor fix was supplied in the data.

Detection Guidance

Sigma Rule

title: Potential Zebra Algorithmic Complexity DoS via High-Volume Minimal Transactions
id: 8f2c1a6e-4b7d-4c1e-9a3f-0d5e6b7c8a91
status: experimental
description: Detects blocks or mempool batches containing an abnormally high count of minimal single-input transactions that could trigger inefficient algorithmic complexity in Zebra before 6.1.0 (CVE-2026-104426).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-104426
author: valtersit.com
date: 2026-06-01
logsource:
  product: zebra
  category: node
  service: block_verification
detection:
  selection_verif_time:
    event: block_contextual_verification
    duration_ms: '> 52000'
  selection_tx_count:
    event: block_contextual_verification
    tx_count: '> 20000'
  selection_single_input:
    event: block_contextual_verification
    single_input_tx_ratio: '> 0.9'
  condition: selection_verif_time and (selection_tx_count or selection_single_input)
falsepositives:
  - Legitimate high-throughput blocks under extreme adoption
  - Batch synchronization during chain reorganizations
level: high

YARA Rule

rule CVE_2026_104426_Zebra_AlgoComplexity_Markers
{
    meta:
        author = "valtersit.com"
        description = "Detects references to remaining_transaction_value and Zebra version markers associated with CVE-2026-104426"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-104426"
        date = "2026-06-01"
        severity = "medium"
    strings:
        $fn = "remaining_transaction_value"
        $zebra = "zebra" nocase
        $ver = /zebra[^\n]{0,20}([0-5]\.\d+\.\d+|6\.0\.\d+)/ nocase
        $spent = "spent" nocase
    condition:
        uint32be(0) == 0x7F454C46 and
        (($fn and $zebra) or ($zebra and $ver) or ($fn and $spent))
}

Suricata IDS Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2026-104426 Zebra Algorithmic Complexity DoS - High Volume Minimal Transaction Burst"; flow:to_server,established; content:"|00|"; depth:1; dsize:>200; threshold:type both, track by_src, count 20000, seconds 60; classtype:denial-of-service; reference:cve,2026-104426; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-104426; sid:2026104426; rev:1;)

Note: Because the exploitation primitive is a high volume of otherwise valid single-input transactions rather than a signature-bearing payload, network detection must rely on volumetric/threshold heuristics at the peer-to-peer or RPC ingestion layer rather than a fixed content match.

Elastic Detection

sequence by host.name with maxspan=60s
  [ network where network.transport == "tcp" and destination.port == 8232 ]
  [ any where event.action == "block_contextual_verification" and zebra.tx_count > 20000 and zebra.single_input_tx_ratio > 0.9 ]

Splunk SPL Query

index=zebra sourcetype=zebra:node:verification event=block_contextual_verification
| stats count as blocks, max(duration_ms) as max_duration_ms, max(tx_count) as max_tx, max(single_input_tx_ratio) as max_single_ratio by host, block_hash
| where (max_duration_ms > 52000 AND max_tx > 20000) OR max_single_ratio > 0.9
| table _time, host, block_hash, max_duration_ms, max_tx, max_single_ratio
| sort - max_duration_ms

Wazuh OSSEC Rule

<group name="zebra,cve-2026-104426,">
  <rule id="104426" level="12">
    <decoded_as>json</decoded_as>
    <field name="event">block_contextual_verification</field>
    <field name="tx_count" type="pcre2">^([2-9][0-9]{4,}|[0-9]{6,})$</field>
    <field name="duration_ms" type="pcre2">^(5[2-9][0-9]{3}|[6-9][0-9]{4,}|[0-9]{6,})$</field>
    <description>CVE-2026-104426: Zebra contextual verification stall with abnormally high single-input transaction count. Possible algorithmic complexity DoS.</description>
    <mitre>
      <id>T1499</id>
    </mitre>
    <group>denial_of_service,availability_impact,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). The NVD description references "before 6.1.0," which establishes 6.1.0 as the version boundary at which the behavior is expected to be resolved, but no vendor advisory, commit, or changelog confirming a fix was present in the supplied data. Treat all instances as unpatched until a verified release is available.

1. Immediate mitigations (where upgrading is not yet possible):

• Monitor node contextual verification latency and transaction counts per block; alert on verification times exceeding 52 seconds or blocks with more than roughly 20,000–26,000 minimal single-input transactions (see detection rules above).
• Rate-limit and profile inbound transaction/block ingestion at the peer and RPC boundaries to reduce the ability of a remote peer to deliver a single block containing tens of thousands of crafted transactions.
• Isolate or segment high-value Zebra nodes (e.g., custody/exchange infrastructure) behind controlled peering and dedicated monitoring so stress on a public-facing node does not cascade to operational services.
• Maintain witness/fallback nodes on an unaffected release or independent implementation to preserve validation continuity during an attack window.
• Apply capacity headroom (CPU/memory) and watchdog resets so a stalled verification does not translate into prolonged downtime.

2. Patch/upgrade steps:

• Upgrade Zebra to version 6.1.0 or later, as indicated by the NVD description's "before 6.1.0" boundary, once a verified vendor release is obtainable through official channels.
• Verify release integrity (signed artifacts/checksums) before deployment; confirm the release notes explicitly address contextual verification performance for remaining_transaction_value.
• Roll out to a canary node first, validate contextual verification latency under synthetic high-volume blocks, then proceed to fleet-wide upgrade during a maintenance window.

3. Long-term hardening:

• Track algorithm-complexity and resource-exhaustion classes (CWE-407) in transaction/block validation code reviews; require complexity analysis of any routine executed per-transaction over block-scoped state.
• Avoid per-transaction cloning of large maps; prefer incremental, shared, or reference-counted state updates to keep per-transaction work linear.
• Instrument verification paths with per-transaction work accounting and enforce configurable ceilings that abort or defer verification of pathological blocks.
• Subscribe to NVD/vendor advisories and monitor EPSS/KEV status; establish standing detection content for high-volume single-input transaction patterns.

References

• NVD — CVE-2026-104426: https://nvd.nist.gov/vuln/detail/CVE-2026-104426
• CWE-407: Inefficient Algorithmic Complexity — https://cwe.mitre.org/data/definitions/407.html
• MITRE ATT&CK T1499: Endpoint Denial of Service — https://attack.mitre.org/techniques/T1499/
• CISA Known Exploited Vulnerabilities Catalog (CVE-2026-104426 not listed as of this report) — https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• FIRST EPSS (no score assigned for CVE-2026-104426 at the time of writing) — https://www.first.org/epss

No public PoC, exploit code, Nuclei template, vendor advisory, or exploit-in-the-wild evidence was available in the supplied data; no known threat actor campaigns are associated with this CVE in the provided intelligence.