Incomplete Cleanup Vulnerability in Zebra by Zcash Foundation
CVE-2026-104421

6.9MEDIUM

Key Information:

Vendor

Zcashfoundation

Status
Zebra
Vendor
CVE Published:
2 October 2026

What is CVE-2026-104421?

The Zebra software prior to version 6.2.1 contains an incomplete cleanup vulnerability that allows unauthenticated peers to interrupt the downloading process of valid blocks. By exploiting this, attackers can leave rejected hashes in SentHashes, thereby causing a situation where contextually invalid blocks can reference a legitimate block's header hash. This leads to the Request::KnownBlock function erroneously skipping over the legitimate block, preventing nodes from syncing correctly and pushing them behind the latest block height.

Affected Version(s)

zebra 0 < 6.2.1

zebra 6.2.1

References

https://github.com/ZcashFoundation/zebra/security/advisor...
vendor-advisory
https://www.vulncheck.com/advisories/zebra-before-6.2.1-b...
third-party-advisory

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.