CVE-2026-104436

Executive Summary

CVE-2026-104436 is an uncontrolled resource consumption vulnerability (CWE-770) in Zebra, an open-source peer-to-peer network implementation, affecting all versions prior to 4.5.0. Remote P2P peers can exhaust blocking-pool threads by sending getblocks or getheaders messages containing oversized block locator vectors (up to 65,535 hashes), triggering per-hash chain lookups that degrade block validation, RPC, and mempool performance. The impact is limited to availability (CVSS 3.7, AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L), but operators of Zebra-based nodes face service degradation and potential node unresponsiveness under sustained abuse.

Technical Analysis

Zebra is a Zcash node implementation written in Rust. This vulnerability resides in the P2P message handling logic for block locator vectors. The getblocks and getheaders P2P message types carry a list of block hashes (locator hashes) that a peer uses to indicate its current chain tip and allow the remote node to respond with the next batch of blocks or headers. The protocol defines a maximum locator vector size of 65,535 entries.

In affected versions, when Zebra receives a getblocks or getheaders message, it processes each locator hash by performing a chain lookup — likely checking the hash against its block index or best-chain data structure to determine the fork point. Because these lookups are handled inside blocking-pool threads (a finite thread pool used for CPU-bound or blocking operations), a single message with the maximum 65,535 locator hashes forces the node to perform 65,535 sequential chain lookups. An attacker can send many such messages concurrently, saturating the blocking-pool thread pool. Once exhausted, other blocking operations — block validation, RPC request handling, and mempool processing — queue behind the malicious requests, degrading or halting node responsiveness.

The root cause is CWE-770: the code fails to bound the resources (thread occupancy and CPU time) consumed per untrusted P2P message. The locator-vector size limit (65,535) is a protocol maximum, not a resource-consumption guard; the implementation does not cap or rate-limit the work per message relative to available blocking-pool capacity. The CVSS vector reflects the attack characteristics: network-accessible (AV:N), high complexity (AC:H — timing and sustained volume required to exhaust the pool), no privileges (PR:N), no user interaction (UI:N), no confidentiality or integrity impact, and limited availability impact (A:L).

No public PoC or exploit code exists for this CVE, and no CNA title was provided. The technical description above is derived strictly from the NVD description; specific function or symbol names in Zebra's codebase are not available and are therefore not asserted.

Exploitation Scenarios

No public PoC is available; the attack chain is inferred from the vulnerability class (uncontrolled resource consumption via oversized P2P messages) and the NVD description.

1. Reconnaissance / target identification. An attacker identifies reachable Zebra nodes by scanning for the Zebra P2P port (commonly TCP 18233 for Zcash mainnet) or by joining the peer-to-peer network directly. Because this is a P2P protocol, any peer that can connect to a node can deliver getblocks and getheaders messages — no authentication is required. Alternatively, an attacker operating a peer on the network can target specific nodes by IP.

2. Triggering the flaw. The attacker establishes a P2P connection and sends a getblocks or getheaders message whose block locator vector contains up to 65,535 hashes. Each hash triggers a per-hash chain lookup on the victim node. A single message thus forces tens of thousands of lookups; sending many such messages amplifies the load.

3. Payload / execution method. At the vulnerability-class level, the payload is a protocol-valid message with an oversized locator vector. The attacker does not need to forge hashes — any 32-byte values are processed — but valid or plausible hashes may drive deeper chain-lookup work. The execution leverages blocking-pool threads, which are consumed per in-flight request.

4. Post-exploitation impact. With blocking-pool threads exhausted, the node's block validation, RPC service, and mempool processing are delayed or stalled. This can cause the node to fall behind the chain tip, drop peers, or become unresponsive to legitimate RPC clients. The impact is availability-only; the description indicates no data corruption, no code execution, and no consensus failure. Sustained abuse could be used as a denial-of-service primitive against specific nodes or against a portion of the network.

Impact Assessment

The CVSS 3.1 base score is 3.7 (Low), with the vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L. Subscores: Attack Vector Network (the P2P interface is remotely reachable), Attack Complexity High (exhausting a thread pool requires sustained message volume and favorable timing), Privileges Required None, User Interaction None, Scope Unchanged, Confidentiality None, Integrity None, Availability Low (degradation rather than full outage under typical conditions).

Business impact is concentrated on availability of Zebra-based nodes: exchanges, custodians, mining pools, and infrastructure providers running Zebra nodes could experience RPC latency or unresponsiveness, delayed block validation, and degraded mempool visibility. Blast radius is per-node — the vulnerability does not enable lateral movement or data exfiltration — but a coordinated campaign against many nodes could degrade network-wide service quality. CISA KEV status is NO, EPSS is not yet scored by FIRST.org, and no exploit code or Nuclei template is known, indicating low current exploitation likelihood but non-zero risk for high-value node operators.

Detection Guidance

Sigma Rule

title: Zebra Oversized Block Locator Vector DoS Attempt
id: 8f3c1a92-4b7e-4d21-9c5a-1e2f3a4b5c6d
status: experimental
description: Detects repeated getblocks/getheaders messages with oversized locator vectors targeting Zebra nodes (CVE-2026-104436).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-104436
author: valtersit.com Threat Intelligence
date: 2026-01-01
logsource:
  product: zebra
  service: p2p
detection:
  selection_msg:
    message_type:
      - 'getblocks'
      - 'getheaders'
  selection_locator:
    locator_hashes: '>= 2000'
  condition: selection_msg and selection_locator
fields:
  - src_ip
  - message_type
  - locator_hashes
falsepositives:
  - Legitimate nodes with very long chains and standard locator vectors (normally capped far below 65,535)
level: medium

YARA Rule

rule CVE_2026_104436_Zebra_Oversized_Locator
{
    meta:
        description = "Detects Zebra getblocks/getheaders locator vectors with abnormally high hash counts (CVE-2026-104436)"
        author = "valtersit.com Threat Intelligence"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-104436"
        severity = "medium"

    strings:
        $msg_getblocks = "getblocks" ascii nocase
        $msg_getheaders = "getheaders" ascii nocase
        $locator = "locator_hashes" ascii nocase

    condition:
        (uint16(0) == 0xE3E1 or true) and
        filesize > 1MB and
        ($msg_getblocks or $msg_getheaders) and
        $locator
}

Suricata IDS Rule

alert tcp any any -> any 18233 (msg:"CVE-2026-104436 Zebra oversized block locator vector DoS attempt"; flow:to_server,established; content:"getblocks"; nocase; content:"getheaders"; nocase; byte_test:2,>,2000,0,relative; threshold:type both, track by_src, count 5, seconds 60; classtype:attempted-dos; sid:2026104436; rev:1; reference:cve,2026-104436;)

Elastic Detection

sequence by source.ip with maxspan=60s
  [network where network.transport == "tcp" and destination.port == 18233
   and network.protocol == "zebra"
   and process.name == "zebrad"]
  [network where network.transport == "tcp" and destination.port == 18233
   and network.protocol == "zebra"
   and network.bytes > 1000000]

Splunk SPL Query

index=network sourcetype=zebra:p2p OR sourcetype=zeek:conn
| search (message_type="getblocks" OR message_type="getheaders")
| stats count AS msg_count, max(locator_hashes) AS max_locator, sum(bytes) AS total_bytes BY src_ip, dest_ip
| where max_locator >= 2000 OR total_bytes > 10000000
| sort - max_locator
| table src_ip dest_ip msg_count max_locator total_bytes

Wazuh OSSEC Rule

<group name="zebra,p2p,attack,">
  <rule id="104436" level="10">
    <decoded_as>json</decoded_as>
    <field name="message_type">getblocks|getheaders</field>
    <field name="locator_hashes" type="pcre2">^\d{4,}$</field>
    <description>CVE-2026-104436: Zebra oversized block locator vector detected from $(srcip)</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>dos,p2p_abuse,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1) Immediate mitigations.

• Upgrade to Zebra 4.5.0 or later, which the NVD description identifies as the fixed version.
• If upgrade is not immediately possible, restrict inbound P2P connectivity to trusted peers via firewall rules or a peer allowlist, reducing the population of hosts that can deliver malicious getblocks/getheaders messages.
• Apply connection rate limiting and per-peer message-rate limits at the network edge to constrain the volume of oversized locator messages a single peer can send.
• Monitor node resource metrics (blocking-pool thread saturation, RPC latency, block validation lag) and alert on anomalies consistent with locator-vector abuse.

2) Patch/upgrade steps.

• Track the Zebra project release channels for version 4.5.0 (or later) and its changelog/security notes.
• Stage the upgrade on non-production nodes first, verify chain sync, RPC responsiveness, and peer stability, then roll out to production infrastructure.
• After upgrade, confirm that locator-vector processing is bounded and no thread-pool exhaustion occurs under test load (send protocol-valid getblocks/getheaders with large locator vectors to a lab node).

3) Long-term hardening.

• Enforce per-message work budgets in P2P handling: cap the number of chain lookups per locator vector and reject or truncate locators beyond a safe threshold.
• Rate-limit and score peer behavior; disconnect peers that repeatedly send maximum-size locator vectors.
• Isolate RPC from P2P resource pools so that P2P-driven blocking work cannot starve RPC or mempool threads.
• Maintain inventory of internet-exposed Zebra nodes and include them in continuous vulnerability management.

References

• NVD — CVE-2026-104436: https://nvd.nist.gov/vuln/detail/CVE-2026-104436
• CWE-770 — Allocation of Resources Without Limits or Throttling: https://cwe.mitre.org/data/definitions/770.html
• Zebra project (Zcash node implementation) release notes and repository — verify version 4.5.0 availability via the project's official release channel.
• CVSS v3.1 Specification Document: https://www.first.org/cvss/v3.1/specification-document
• CISA Known Exploited Vulnerabilities Catalog (for KEV status verification): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No public exploit code, PoC, or Nuclei template is known for this CVE. There is no evidence of exploit-in-the-wild activity or association with a named threat actor campaign. CISA KEV status is NO; EPSS is not yet scored by FIRST.org.