What is GHSA-g338-vc6m-x872?

GHSA-g338-vc6m-x872 is a security advisory published by GitHub Security Advisories with High severity. Zebra before 6.1.0 contains an inefficient algorithmic complexity vulnerability in...

Which CVE IDs does GHSA-g338-vc6m-x872 cover?

GHSA-g338-vc6m-x872 covers the following CVE IDs: CVE-2026-104426. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-g338-vc6m-x872?

GHSA-g338-vc6m-x872 has a CVSS v3 base score of 5.9, published by GitHub Security Advisories.

GHSA-g338-vc6m-x872HighCVSS 5.9

Zebra before 6.1.0 contains an inefficient algorithmic complexity vulnerability in...

Vendor

GitHub Security Advisories

Published

October 2, 2026

Last Modified

October 2, 2026

🔗 CVE IDs covered (1)

CVE-2026-104426 →

📋 Description

Zebra before 6.1.0 contains an inefficient algorithmic complexity vulnerability in remaining_transaction_value that clones the entire block-level spent-UTXO map per transaction during contextual verification. Attackers can mine or seed the mempool with roughly 26,000 minimal single-input transactions in one block, stalling every validating node for over 52 seconds.

🔗 References (4)

https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-4g24-549m-hp75
https://nvd.nist.gov/vuln/detail/CVE-2026-104426
https://www.vulncheck.com/advisories/zebra-before-6.1.0-quadratic-complexity-dos-via-block-transparent-value-check
https://github.com/advisories/GHSA-g338-vc6m-x872