CVE-2026-104419CWE-345

CVE-2026-104419

Medium · published October 2, 2026

CVSS v3.1
4.8
EPSS
0%
Percentile
2.1
In the wild
Unconfirmed
What it is

Zebra (zebrad) 4.5.0 before 6.3.0 discards which peer supplied the block hashes in FindBlocks responses, then assigns 100 misbehavior points, the ban threshold, to whichever peer serves a requested block more than 50,000 heights above the tip. A remote peer can return real far-ahead hashes to a syncing node so that honest peers get banned, eroding its peer set and raising eclipse risk.

The record
Technical detail
CVSS v3.1
4.8 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L
CVSS v4.0
6.3 · CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N
EPSS
0.00126 · 2.1th percentile
Weakness
CWE-345 · Insufficient Verification of Data Authenticity
Published
2026-10-02T16:17Z
References (2)
https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-qhr3-cvch-5fh2 · [email protected]https://www.vulncheck.com/advisories/zebra-before-6.3.0-honest-peer-banning-via-far-ahead-findblocks-hashes · [email protected]
EPSS history
Timeline
  • 04 OCT 03:27Z
    EPSS moved — → 0%
    epss
  • 02 OCT 11:38Z
    Zebra before 6.3.0 Honest Peer Banning via Far-Ahead FindBlocks Hashes
    cvelistv5