CVE-2026-104420

MEDIUMCVSS 5.3

Description

Zebra before 6.3.0 contains a protection mechanism failure that allows unauthenticated peers to evade misbehavior scoring by supplying invalid gossiped blocks. The inbound cleanup step wrongly downcasts RouterError to VerifyBlockError and discards the score, so attackers can repeatedly force block download and Equihash verification without being banned.

Timeline

Published:October 2nd, 2026 12:17 PM

Last modified:October 6th, 2026 3:17 AM

CVSS Scoring

CVSS v3: 5.3 (MEDIUM)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Weaknesses (CWE)

CWE-704

References & Reports

Advisories, patches, and third-party reports

https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-8hh2-hrf2-cqf4
https://www.vulncheck.com/advisories/zebra-before-6.3.0-peer-misbehavior-ban-bypass-via-gossiped-blocks

Source: NIST NVD · Data may lag official sources by up to one minute