CVE-2026-104431

Executive Summary

CVE-2026-104431 is a denial-of-service vulnerability in the Zebra cryptocurrency node software affecting versions before 6.0.0. An unauthenticated remote peer can submit specially crafted non-standard high-sigop P2SH mempool transactions that reach synchronous script verification logic (CachedFfiTransaction::is_valid()) before standardness checks are applied, saturating the verifier buffer and causing Tokio worker thread starvation. Successful exploitation renders the node unresponsive, disrupting block propagation, transaction relay, and RPC availability for the targeted operator.

Technical Analysis

Zebra is a Rust-based implementation of a Zcash full node that uses the Tokio asynchronous runtime for concurrent network and RPC processing. The vulnerability arises from an ordering flaw in the transaction validation pipeline: transactions received from unauthenticated peers are routed toward expensive synchronous script verification via CachedFfiTransaction::is_valid() before they are subjected to standardness checks that would normally reject non-standard, high-signature-operation (high-sigop) transactions.

The root cause falls under CWE-405 (Asymmetric Resource Consumption / Amplification). Each crafted transaction forces the node to perform disproportionate CPU-bound script verification work relative to the small amount of network data required to submit it. Because the verification path is synchronous and invokes an FFI bridge (the is_valid() method on a cached FFI transaction wrapper), the expensive work blocks Tokio worker threads rather than yielding cooperatively to the async scheduler. When an attacker floods the mempool with many such non-standard P2SH transactions:

• The verifier buffer saturates, exhausting the bounded capacity intended to absorb legitimate verification work.
• Tokio worker threads become blocked in synchronous script evaluation, starving the runtime of threads available for networking, block download, and RPC handling.
• The node becomes unresponsive to legitimate peers and operators, resulting in denial of service.

The attack surface is the peer-to-peer mempool ingestion path — no authentication, no privileged access, and no user interaction are required, consistent with the CVSS vector (AV:N/AC:L/PR:N/UI:N). Confidentiality and integrity are unaffected (C:N/I:N); the entire severity derives from availability impact (A:H). The specific script opcode composition of the "high-sigop" transactions is not detailed in available advisories, and insufficient technical detail is available to enumerate exact opcode sequences beyond the description of "non-standard high-sigop P2SH" transactions.

Exploitation Scenarios

No public proof-of-concept is available; the attack chain below is inferred from the vulnerability class and the NVD description.

1. Reconnaissance / target identification. An attacker identifies reachable Zebra nodes by scanning for the Zcash P2P service (commonly TCP port 8233) or fingerprinting Zebra-specific RPC/HTTP behavior. Because the flaw is triggered over the peer-to-peer interface, any internet-exposed node accepting inbound peers is a candidate target.

2. Triggering the flaw class. The attacker connects as an ordinary, unauthenticated peer and transmits mempool transaction advertisements/messages containing non-standard high-sigop P2SH transactions. These transactions are deliberately constructed to bypass the checks that would ordinarily reject non-standard scripts, reaching CachedFfiTransaction::is_valid() first. Each submission forces synchronous, CPU-intensive script verification.

3. Payload/execution method (class level). No memory corruption or code execution is involved. The "payload" is simply volume and composition of verification-heavy transactions. By sending them repeatedly and in quantity, the attacker saturates the verifier buffer and pins Tokio worker threads in synchronous FFI script evaluation, so the async runtime can no longer service normal tasks.

4. Post-exploitation impact. With worker threads starved, the node stops relaying transactions and blocks, stops responding to RPC requests, and may be dropped by peers. The operator loses node availability; downstream services depending on that node (wallets, explorers, mining infrastructure) are disrupted. There is no evidence of data exfiltration or state modification — impact is confined to availability.

Impact Assessment

The CVSS v3.1 base score is 7.5 (High): AV:N (remotely reachable over the network), AC:L (no special conditions — simply sending crafted transactions), PR:N (any unauthenticated peer), UI:N (no victim interaction), S:U (impact stays within the node), C:N/I:N (no confidentiality or integrity loss), and A:H (complete loss of availability of the node process).

Business impact centers on availability:

• Node operators running Zebra < 6.0.0, including miners, exchanges, custodial services, and infrastructure providers relying on Zcash node connectivity, face service outage.
• Blast radius is per-node: an attacker can target multiple nodes, and since the flaw is trivially triggered by any peer, an adversary with modest bandwidth can sustain the condition and extend the outage.
• Secondary effects include peer eviction, missed block/transaction relay, stalled wallet and RPC-backed services, and potential monitoring/alerting gaps if the node that generates telemetry is itself taken down.

Because exploitation requires no authentication or user interaction and is low complexity, the fault is well-suited to sustained, low-effort denial-of-service campaigns.

Detection Guidance

Detection centers on anomalous inbound mempool traffic, verification-buffer saturation, and Tokio worker starvation on Zebra nodes. Network-layer rules look for high volumes of P2SH transaction submissions from single peers; host-layer rules look for verifier saturation and stalled RPC responsiveness.

Sigma Rule

title: Zebra Node Denial of Service via High-Sigop P2SH Mempool Flood
id: 7b1c2f4a-9d3e-4a5b-8c6f-1e2d3a4b5c6d
status: experimental
description: Detects Zebra node log or process indicators consistent with CVE-2026-104431, where unauthenticated peers flood non-standard high-sigop P2SH transactions that saturate the verifier buffer and stall Tokio workers.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-104431
author: valtersit.com Threat Intelligence
date: 2026/01/01
logsource:
  product: zebra
  service: node
detection:
  selection_verifier:
    message|contains:
      - 'verifier buffer'
      - 'is_valid'
      - 'verify'
  selection_saturation:
    message|contains:
      - 'buffer full'
      - 'channel full'
      - 'mempool'
  selection_tokio:
    message|contains:
      - 'tokio'
      - 'worker thread'
      - 'blocking'
  condition: selection_verifier and (selection_saturation or selection_tokio)
fields:
  - timestamp
  - peer_addr
  - message
falsepositives:
  - Legitimate high-load periods with verbose verifier logging
level: high
tags:
  - attack.t1499
  - cwe.405

YARA Rule

rule CVE_2026_104431_Zebra_HighSigop_DoS
{
    meta:
        author = "valtersit.com Threat Intelligence"
        description = "Detects indicators of CVE-2026-104431 high-sigop P2SH mempool DoS targeting Zebra nodes"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-104431"
        date = "2026-01-01"
        severity = "high"

    strings:
        $zebra     = "zebra" ascii nocase
        $verifier  = "verifier" ascii nocase
        $ffi       = "CachedFfiTransaction" ascii
        $is_valid  = "is_valid" ascii
        $sigop     = "sigop" ascii nocase
        $p2sh      = "P2SH" ascii nocase
        $mempool   = "mempool" ascii nocase

    condition:
        (
            $ffi or $is_valid
        ) and (
            $verifier or $sigop or $p2sh or $mempool
        )
}

Suricata IDS Rule

alert tcp any any -> any 8233 ( \
  msg:"CVE-2026-104431 Possible Zebra High-Sigop P2SH Mempool DoS Attempt"; \
  flow:established,to_server; \
  threshold:type both, track by_src, count 50, seconds 60; \
  classtype:attempted-dos; \
  reference:cve,2026-104431; \
  reference:url,nvd.nist.gov/vuln/detail/CVE-2026-104431; \
  sid:2026104431; rev:1; )

Elastic Detection

sequence by process.entity_id with maxspan=2m
  [process where process.name == "zebra" and message like~ "verifier*"]
  [process where process.name == "zebra" and (message like~ "*buffer*full*" or message like~ "*channel*full*")]
  [process where process.name == "zebra" and (message like~ "*tokio*" or message like~ "*blocking*")]

Splunk SPL Query

index=zebra sourcetype=zebra:node
| search ("verifier buffer" OR "is_valid" OR "buffer full" OR "channel full" OR "tokio")
| eval peer_ip=coalesce(peer_addr, src_ip)
| stats count AS events, values(message) AS messages BY peer_ip
| where events > 20
| sort - events
| table peer_ip, events, messages

Wazuh OSSEC Rule

<group name="zebra,cve-2026-104431,">
  <rule id="1044310" level="10">
    <decoded_as>zebra</decoded_as>
    <match>verifier buffer|is_valid|buffer full|channel full</match>
    <description>CVE-2026-104431: Zebra node verifier buffer saturation / high-sigop P2SH mempool DoS indicator</description>
    <mitre>
      <id>T1499</id>
    </mitre>
    <group>denial_of_service,</group>
  </rule>

  <rule id="1044311" level="12" frequency="10" timeframe="60">
    <if_matched_sid>1044310</if_matched_sid>
    <same_source_ip />
    <description>CVE-2026-104431: repeated Zebra verifier saturation from same peer - probable sustained DoS</description>
    <mitre>
      <id>T1499</id>
    </mitre>
    <group>denial_of_service,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations (while unpatched):

   • Do not expose the Zebra P2P port (default 8233) directly to untrusted networks where avoidable; restrict inbound peer connections to vetted peers where operationally feasible, using firewall rules or connection whitelisting.
   • Apply rate limiting on inbound peer connections and inbound transaction submission at the network edge to reduce the volume of high-sigop transactions a single peer can deliver.
   • Monitor verifier-buffer saturation and Tokio worker responsiveness; configure alerting on the detection rules above so operators can react (e.g., disconnect offending peers) before full unavailability.
   • Maintain redundant/HA node infrastructure so a single stalled node does not cause a full service outage.

2. Patch/upgrade steps: Upgrade to Zebra 6.0.0 or later, which is the fixed release boundary identified in the advisory ("Zebra before 6.0.0"). Validate the upgrade in a test environment, confirm peer and RPC functionality, and then roll out to production nodes. No patch has been confirmed available from any tracked source, so verify release notes directly from the Zebra project before deployment.

3. Long-term hardening: Ensure standardness checks precede expensive synchronous verification in the transaction pipeline (the apparent root cause); enforce bounded, asynchronous-friendly work queues for script verification; adopt peer scoring/reputation to automatically ban peers submitting abusive transaction volumes; and keep node software current with upstream security releases.

References

• NVD — CVE-2026-104431: https://nvd.nist.gov/vuln/detail/CVE-2026-104431
• MITRE CWE-405 (Asymmetric Resource Consumption / Amplification): https://cwe.mitre.org/data/definitions/405.html
• MITRE ATT&CK T1499 (Endpoint Denial of Service): https://attack.mitre.org/techniques/T1499/
• Zebra project repository and release notes (verify fix availability for 6.0.0): https://github.com/ZcashFoundation/zebra
• FIRST EPSS — no score available at time of writing (not yet scored); no CISA KEV entry, no public PoC, and no exploit code identified in available sources.