Peer Misbehavior Ban Bypass in Zebra by Zcash Foundation
CVE-2026-104420

6.9MEDIUM

Key Information:

Vendor

Zcashfoundation

Status
Zebra
Vendor
CVE Published:
2 October 2026

What is CVE-2026-104420?

Zebra, developed by Zcash Foundation, exhibits a failure in its protection mechanism prior to version 6.3.0, enabling unauthorized peers to evade misbehavior scoring. This vulnerability arises from the incorrect handling of errors during the inbound cleanup step, where RouterError is incorrectly downcast to VerifyBlockError. This oversight allows attackers to continuously force block downloads and Equihash verifications, preventing their bans due to misbehavior. As a result, the system remains vulnerable to repeated exploitation via invalid gossiped blocks.

Affected Version(s)

zebra 0 < 6.3.0

zebra 6.3.0

References

https://github.com/ZcashFoundation/zebra/security/advisor...
vendor-advisory
https://www.vulncheck.com/advisories/zebra-before-6.3.0-p...
third-party-advisory

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

evan-forbes
.