Improper Condition Check in Zebra Affects Synchronization Functions

CVE-2026-104432

What is CVE-2026-104432?

Zebra software before version 6.3.0 contains an improper exceptional condition check in the ChainSync::obtain_tips function. This flaw leads to the erroneous discarding of valid one-hash FindBlocks responses, which in turn results in false reporting of the node's sync status. Specifically, when peers return only the next block hash, it can create a zero-length synchronization sample. Consequently, the /ready endpoint may erroneously return a 200 OK status, misleading users into believing the node is up-to-date, while it is actually lagging behind the network's current state.

References