CVE-2026-104419: Insufficient Verification of Data Authenticity in ZcashFoundation zebra
Zebra (zebrad) 4.5.0 before 6.3.0 discards which peer supplied the block hashes in FindBlocks responses, then assigns 100 misbehavior points, the ban threshold, to whichever peer serves a requested block more than 50,000 heights above the tip. A remote peer can return real far-ahead hashes to a syncing node so that honest peers get banned, eroding its peer set and raising eclipse risk.
AI Analysis
Technical Summary
Zebra (zebrad) versions >=0 and <6.3.0 discard the identity of the peer that supplies block hashes in FindBlocks responses. When a requested block is more than 50,000 heights ahead of the current tip, the node assigns 100 misbehavior points (the ban threshold) to the peer serving the block. A remote attacker can exploit this by returning legitimate far-ahead hashes, causing the node to ban honest peers and thereby degrade the peer set, increasing the risk of eclipse attacks.
Potential Impact
The vulnerability can lead to honest peers being banned incorrectly, which reduces the number of available peers for synchronization. This erosion of the peer set can increase the risk of eclipse attacks, where an attacker isolates a node by controlling its peer connections. The CVSS 4.0 score is 6.3 (medium severity), indicating a moderate impact with network attack vector, high attack complexity, and partial impact on integrity and availability.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Users should monitor the Zebra project for updates and apply any official fixes once available. Until then, caution is advised when syncing with peers to avoid potential eclipse risks.
CVE-2026-104419: Insufficient Verification of Data Authenticity in ZcashFoundation zebra
Description
Zebra (zebrad) 4.5.0 before 6.3.0 discards which peer supplied the block hashes in FindBlocks responses, then assigns 100 misbehavior points, the ban threshold, to whichever peer serves a requested block more than 50,000 heights above the tip. A remote peer can return real far-ahead hashes to a syncing node so that honest peers get banned, eroding its peer set and raising eclipse risk.
CVSS v4.0
Score 6.3medium
Affected software
ZcashFoundation
zebra
pkg:github/zcashfoundation/zebraRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Zebra (zebrad) versions >=0 and <6.3.0 discard the identity of the peer that supplies block hashes in FindBlocks responses. When a requested block is more than 50,000 heights ahead of the current tip, the node assigns 100 misbehavior points (the ban threshold) to the peer serving the block. A remote attacker can exploit this by returning legitimate far-ahead hashes, causing the node to ban honest peers and thereby degrade the peer set, increasing the risk of eclipse attacks.
Potential Impact
The vulnerability can lead to honest peers being banned incorrectly, which reduces the number of available peers for synchronization. This erosion of the peer set can increase the risk of eclipse attacks, where an attacker isolates a node by controlling its peer connections. The CVSS 4.0 score is 6.3 (medium severity), indicating a moderate impact with network attack vector, high attack complexity, and partial impact on integrity and availability.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Users should monitor the Zebra project for updates and apply any official fixes once available. Until then, caution is advised when syncing with peers to avoid potential eclipse risks.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-10-02T00:44:44.529Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6abf99afa43b0b3b89b268fe
Added to database: 10/02/2026, 11:46:55 UTC
Last enriched: 10/02/2026, 12:17:01 UTC
Last updated: 10/02/2026, 23:15:31 UTC
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.