CVE-2026-123556Medium· 5.3▾ SunlitZcashFoundation Zebra from 4.5.0 before 7.0.0 contains a protection mechanism failure that bans honest peers by scoring mempool lock-time rejections at the ban threshold. Attackers can broadcast transactions locked until the current heig…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 29.2 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
ZcashFoundation Zebra from 4.5.0 before 7.0.0 contains a protection mechanism failure that bans honest peers by scoring mempool lock-time rejections at the ban threshold. Attackers can broadcast transactions locked until the current height right after each block, causing lagging nodes to ban honest relaying peers for 24 hours or until restart.
zebra >= 4.5.0 < 7.0.0Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-109364Medium· 5.3Zebra 2.3.0 before 6.4.0 contains a protection mechanism failure that allows unauthenticated peers to evade bans because bans and misbehavior scores are keyed on exact IP addresses
CVE-2026-123554High· 7.5Zebra zebrad 6.4.0 before 7.0.0 Denial of Service via Mempool Coinbase-Maturity Check
CVE-2026-123555High· 7.5Zebra 2.3.0 before 7.0.0 Denial of Service via Unscored Script Verification Failures
CVE-2026-123558High· 7.5Zebra before 7.0.0 Checkpoint Sync Denial of Service via Cancelled Verifier Rewind
CVE-2026-123557Medium· 5.9Zebra zebrad before 7.0.0 Reachable Assertion DoS via Peer Disconnection
CVE-2026-123560High· 7.5Zebra before 7.0.0 Sync Denial of Service via Forged Checkpoint Block Body