CVE-2026-123560: high-severity vulnerability in ZcashFoundation zebra
Zebra before 7.0.0 Sync Denial of Service via Forged Checkpoint Block Body
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 8.7epss 0.3%
Zebra before 7.0.0 contains an incomplete cleanup vulnerability that allows unauthenticated peers to stall initial sync by serving a forged checkpoint block body. Attackers can supply a body with forged authorizing data near the final checkpoint, leaving rejected hashes in the sent-hash set so the node stops requesting blocks until restart.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Affected products
ZcashFoundation · zebraRelated CVEs — ZcashFoundation zebra
In the same product, most dangerous first.
CVE-2026-34202CRITICALZebra node crash — V5 transaction hash panic (P2P reachable)EPSS 0.8%CVE-2026-52736HIGHZEBRA: Block suppression via NU5 same-header body poisoning of sent-hash cacheEPSS 0.6%CVE-2026-52829HIGHZEBRA: IPv4-Mapped Mempool Misbehavior Update Aborts Zebra Address BookEPSS 0.6%CVE-2026-52731MEDIUMZEBRA: Full node denial of service via non-ASCII LongPollId in getblocktemplateEPSS 0.5%CVE-2026-52739MEDIUMZEBRA: Repeated Non-Finalized Shielded Transaction Aborts Zebra Before Duplicate-Nullifier RejectionEPSS 0.5%CVE-2026-52732MEDIUMZEBRA: Mempool transaction admission denial via single-peer inbound queue saturationEPSS 0.5%