Vulnerability · Published Oct 2, 2026 · Assigned by VulnCheck

CVE-2026-104419Zebra before 6.3.0 Honest Peer Banning via Far-Ahead FindBlocks Hashes

Medium 4.8

In plain English

A medium-severity insufficient verification of data authenticity in zebra from ZcashFoundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 2% of all known vulnerabilities).

Severity (CVSS 3.1)4.8Medium

Exploit odds (30 days)0.1%top 97.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Zebra (zebrad) 4.5.0 before 6.3.0 discards which peer supplied the block hashes in FindBlocks responses, then assigns 100 misbehavior points, the ban threshold, to whichever peer serves a requested block more than 50,000 heights above the tip. A remote peer can return real far-ahead hashes to a syncing node so that honest peers get banned, eroding its peer set and raising eclipse risk.

Affected products (as reported)

Vendor	Product	Versions
ZcashFoundation	zebra	0 – before 6.3.0

Weakness: CWE-345 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L

References

GitHub Security Advisory (GHSA-qhr3-cvch-5fh2) vendor-advisory
VulnCheck Advisory: Zebra before 6.3.0 Honest Peer Banning via Far-Ahead FindBlocks Hashes third-party-advisory