Remote Peer Input Processing Flaw in Zebra by Zcash Foundation
CVE-2026-104419

6.3MEDIUM

Key Information:

Vendor

Zcashfoundation

Status
Zebra
Vendor
CVE Published:
2 October 2026

What is CVE-2026-104419?

Zebra versions prior to 6.3.0 are vulnerable to a remote peer attack that exploits the FindBlocks response mechanism. A malicious peer can return block hashes for forks that are far ahead (more than 50,000 block heights), leading to the honest peer being incorrectly assigned misbehavior points. This can result in the honest node being banned from the network, diminishing its peer connections and increasing the risk of eclipse attacks. This vulnerability highlights critical weaknesses in input validation and network peer handling within the Zebra blockchain software ecosystem.

Affected Version(s)

zebra 0 < 6.3.0

zebra 6.3.0

References

https://github.com/ZcashFoundation/zebra/security/advisor...
vendor-advisory
https://www.vulncheck.com/advisories/zebra-before-6.3.0-h...
third-party-advisory

CVSS V4

Score:
6.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

zakura-security
.