CVE-2026-123560High· 7.5▾ TwilightZebra before 7.0.0 contains an incomplete cleanup vulnerability that allows unauthenticated peers to stall initial sync by serving a forged checkpoint block body. Attackers can supply a body with forged authorizing data near the final ch…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Zebra before 7.0.0 contains an incomplete cleanup vulnerability that allows unauthenticated peers to stall initial sync by serving a forged checkpoint block body. Attackers can supply a body with forged authorizing data near the final checkpoint, leaving rejected hashes in the sent-hash set so the node stops requesting blocks until restart.
zebra < 7.0.0Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-104427Medium· 5.9Zebra before 6.1.0 contains an incomplete cleanup vulnerability in the state write task that allows remote unauthenticated peers to stall node synchronization by poisoning parent_error_map
CVE-2026-104421Medium· 5.3Zebra before 6.2.1 contains an incomplete cleanup vulnerability that allows unauthenticated peers to block downloading of valid blocks by leaving rejected hashes in SentHashes
CVE-2026-123554High· 7.5Zebra zebrad 6.4.0 before 7.0.0 Denial of Service via Mempool Coinbase-Maturity Check
CVE-2026-123555High· 7.5Zebra 2.3.0 before 7.0.0 Denial of Service via Unscored Script Verification Failures
CVE-2026-123558High· 7.5Zebra before 7.0.0 Checkpoint Sync Denial of Service via Cancelled Verifier Rewind
CVE-2026-123556Medium· 5.3Zebra 4.5.0 before 7.0.0 Honest Peer Ban via Mempool Lock-Time Scoring