CVE-2026-104426 affects Zebra prior to version 6.1.0. The vulnerability arises from an inefficient algorithmic complexity in the remaining_transaction_value function, which clones the entire block-level spent-UTXO map for each transaction during contextual verification. This inefficiency can be exploited by attackers who create a large number of minimal single-input transactions (around 26,000) in a single block, resulting in a denial-of-service condition by stalling every validating node for more than 52 seconds.

The vulnerability can cause a denial-of-service condition on Zebra validating nodes by significantly delaying transaction verification. This can stall nodes for over 52 seconds when processing a block containing a large number of minimal single-input transactions, potentially disrupting normal blockchain validation and network operations.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vulnerability affects Zebra versions before 6.1.0, upgrading to version 6.1.0 or later is implied as a remediation step once confirmed by the vendor. Until an official fix is available, operators should monitor vendor communications for patches or temporary mitigations.