Incomplete Cleanup Vulnerability in Zebra Software by Zcash Foundation

CVE-2026-104427

What is CVE-2026-104427?

The Zebra software, developed by the Zcash Foundation, is susceptible to an incomplete cleanup vulnerability within the state write task. This flaw permits remote unauthenticated attackers to introduce a denial of service by stalling node synchronization. By leveraging the ability to poison the parent_error_map, a malicious entity could propagate a coinbase-malleated block that shares the hash of a canonical block. Consequently, this manipulation results in the inability of the node to process subsequent canonical blocks, stalling the network for approximately 2,000 blocks. This vulnerability emphasizes the need for prompt updates and vigilant security practices within blockchain applications.

References