Vulnerability · Published Oct 2, 2026 · Assigned by VulnCheck

CVE-2026-104436Zebra before 4.5.0 CPU Amplification via Uncapped getblocks/getheaders Locator Length

Low 3.7

In plain English

A low-severity resource allocation without limits in zebra from ZcashFoundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 20% of all known vulnerabilities).

Severity (CVSS 3.1)3.7Low

Exploit odds (30 days)0.3%top 80.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Zebra before 4.5.0 contains an uncontrolled resource consumption vulnerability that allows remote P2P peers to exhaust blocking-pool threads by sending oversized block locator vectors. Attackers can send getblocks or getheaders messages with up to 65,535 locator hashes, triggering per-hash chain lookups that degrade block validation, RPC, and mempool performance.

Affected products (as reported)

Vendor	Product	Versions
ZcashFoundation	zebra	0 – before 4.5.0
ZcashFoundation	zebra-chain	0 – before 8.0.0

Weakness: CWE-770 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

References

GitHub Security Advisory (GHSA-443g-gwgp-49x4) vendor-advisory
VulnCheck Advisory: Zebra before 4.5.0 CPU Amplification via Uncapped getblocks/getheaders Locator Length third-party-advisory