CVE-2026-104419
Medium
Description
Zebra (zebrad) 4.5.0 before 6.3.0 discards which peer supplied the block hashes in FindBlocks responses, then assigns 100 misbehavior points, the ban threshold, to whichever peer serves a requested block more than 50,000 heights above the tip. A remote peer can return real far-ahead hashes to a syncing node so that honest peers get banned, eroding its peer set and raising eclipse risk.
SeverityMedium
CVSS4.8
Exploit probability—
ProductZcashfoundation Zebra
PublishedOct 2, 2026
First seenOct 2, 2026
Weakness typeCWE-345CWE-345
How to fix
Update
- ZcashFoundation zebra6.3.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| ZcashFoundation zebra | v < 6.3.0 | 6.3.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.