Threats tagged 'ghsa-5872-wrc4-qh77'

Zebra zebrad versions 6.4.0 up to but not including 7.0.0 contain a vulnerability where the mempool coinbase-maturity check performs quadratic work. This occurs because the function Transaction::coinbase_spend_restriction() rebuilds the transaction's output list repeatedly for each spent outpoint. An attacker can exploit this by sending many unsigned transactions with numerous transparent inputs and outputs, causing excessive CPU usage and pinning verification threads without incurring a misbehavior score.