CVE-2026-104420CWE-704

CVE-2026-104420

Medium · published October 2, 2026

CVSS v3.1
5.3
EPSS
0%
Percentile
22.1
In the wild
Unconfirmed
What it is

Zebra before 6.3.0 contains a protection mechanism failure that allows unauthenticated peers to evade misbehavior scoring by supplying invalid gossiped blocks. The inbound cleanup step wrongly downcasts RouterError to VerifyBlockError and discards the score, so attackers can repeatedly force block download and Equihash verification without being banned.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CVSS v4.0
6.9 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
EPSS
0.00304 · 22.1th percentile
Weakness
CWE-704 · Incorrect Type Conversion or Cast
Published
2026-10-02T16:17Z
References (2)
https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-8hh2-hrf2-cqf4 · [email protected]https://www.vulncheck.com/advisories/zebra-before-6.3.0-peer-misbehavior-ban-bypass-via-gossiped-blocks · [email protected]
EPSS history
Timeline
  • 04 OCT 03:27Z
    EPSS moved — → 0%
    epss
  • 02 OCT 11:38Z
    Zebra before 6.3.0 Peer Misbehavior Ban Bypass via Gossiped Blocks
    cvelistv5