CVE-2026-104419

MEDIUMCVSS 4.8

Description

Zebra (zebrad) 4.5.0 before 6.3.0 discards which peer supplied the block hashes in FindBlocks responses, then assigns 100 misbehavior points, the ban threshold, to whichever peer serves a requested block more than 50,000 heights above the tip. A remote peer can return real far-ahead hashes to a syncing node so that honest peers get banned, eroding its peer set and raising eclipse risk.

Timeline

Published:October 2nd, 2026 12:17 PM

Last modified:October 5th, 2026 4:17 PM

CVSS Scoring

CVSS v3: 4.8 (MEDIUM)

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L

Weaknesses (CWE)

CWE-345

References & Reports

Advisories, patches, and third-party reports

https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-qhr3-cvch-5fh2
https://www.vulncheck.com/advisories/zebra-before-6.3.0-honest-peer-banning-via-far-ahead-findblocks-hashes

Source: NIST NVD · Data may lag official sources by up to one minute