CVE-2026-104436

3.7 LOWpublic exploit available

Published 2026-10-02 · Updated 2026-10-02

AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.

NVD description

Zebra before 4.5.0 contains an uncontrolled resource consumption vulnerability that allows remote P2P peers to exhaust blocking-pool threads by sending oversized block locator vectors. Attackers can send getblocks or getheaders messages with up to 65,535 locator hashes, triggering per-hash chain lookups that degrade block validation, RPC, and mempool performance.

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

Weaknesses

CWE-770

Public exploit & PoC references

https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-443g-gwgp-49x4

All references

https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-443g-gwgp-49x4
https://www.vulncheck.com/advisories/zebra-before-4.5.0-cpu-amplification-via-uncapped-getblocks-getheaders-locator-length

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

HIGHCVE-2023-54404PoC
MEDIUMCVE-2025-12767
UNSCOREDCVE-2025-8352
MEDIUMCVE-2026-100274
MEDIUMCVE-2026-100350PoC
MEDIUMCVE-2026-100508
MEDIUMCVE-2026-100600PoC
LOWCVE-2026-100649PoC

Related by shared AI tags and CWE weakness class. Browse the full archive.