CVE-2026-104419
Zebra before 6.3.0 Honest Peer Banning via Far-Ahead FindBlocks Hashes
- State
- Published
- Severity
- 6.3 Medium
- Published
- Oct 2, 2026
- Updated
- Oct 5, 2026
- Reserved
- Oct 2, 2026
Description
Zebra (zebrad) 4.5.0 before 6.3.0 discards which peer supplied the block hashes in FindBlocks responses, then assigns 100 misbehavior points, the ban threshold, to whichever peer serves a requested block more than 50,000 heights above the tip. A remote peer can return real far-ahead hashes to a syncing node so that honest peers get banned, eroding its peer set and raising eclipse risk.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 6.3 Medium | CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 4.8 Medium | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L | VulnCheck |
Weaknesses
- CWE-345 Insufficient Verification of Data Authenticity
Affected Products
| Product | Versions |
|---|---|
zebraZcashFoundation |
|
References
- GitHub Security Advisory (GHSA-qhr3-cvch-5fh2)vendor-advisory
- VulnCheck Advisory: Zebra before 6.3.0 Honest Peer Banning via Far-Ahead FindBlocks Hashesthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.