Description
Zebra before 6.1.0 contains an inefficient algorithmic complexity vulnerability in remaining_transaction_value that clones the entire block-level spent-UTXO map per transaction during contextual verification. Attackers can mine or seed the mempool with roughly 26,000 minimal single-input transactions in one block, stalling every validating node for over 52 seconds.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| ZcashFoundation | zebra | < 6.1.0 | 6.1.0 |
References
- GitHub Security Advisory (GHSA-4g24-549m-hp75) vendor-advisory
- VulnCheck Advisory: Zebra before 6.1.0 Quadratic Complexity DoS via Block Transparent Value Check third-party-advisory