Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2026-104419— Zebra before 6.3.0 Honest Peer Banning via Far-Ahead FindBlocks Hashes

Quick assessment

Affected

ZcashFoundation zebra

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 Zebra（zebrad）4.5.0 至 6.3.0（不含）版本中，系统在处理 FindBlocks 响应时会丢弃提供区块哈希的同行节点标识，并将 100 分（即封禁阈值）的行为不端点数分配给任何提供比链尖高出超过 50,000 个高度的区块的同行节点。远程同行节点可以向同步中的节点返回真实但高度过远的区块哈希，从而导致诚实同行节点被封禁，削弱其同行节点集合，增加被隔离攻击（eclipse attack）的风险。

CVSS 4.8 · Medium Updated Oct 02, 2026

Possible ATT&CK Techniques 1 AI

T1498 · Network Denial of Service

Affected Version Matrix 2

Vendor	Product	Version Range	Status
ZcashFoundation	zebra	`< 6.3.0`	affected
		`6.3.0`	unaffected

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Zebra before 6.3.0 Honest Peer Banning via Far-Ahead FindBlocks Hashes

Source: CVE Program / CVE List V5

Vulnerability Description

Zebra (zebrad) 4.5.0 before 6.3.0 discards which peer supplied the block hashes in FindBlocks responses, then assigns 100 misbehavior points, the ban threshold, to whichever peer serves a requested block more than 50,000 heights above the tip. A remote peer can return real far-ahead hashes to a syncing node so that honest peers get banned, eroding its peer set and raising eclipse risk.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L

Source: CVE Program / CVE List V5

Vulnerability Type

对数据真实性的验证不充分

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
ZcashFoundation	zebra	0 ~ 6.3.0	-

II. Public POCs for CVE-2026-104419

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-104419

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-104419 (1)

🔗 Far-ahead FindBlocks hashes cause Zebra to ban honest peers that serve requested blocks · Advisory · ZcashFoundation/zebra · GitHub Read full article vendor-advisory

Other References for CVE-2026-104419 (1)

🔗 Zebra before 6.3.0 Honest Peer Banning via Far-Ahead FindBlocks Hashes | Advisories | VulnCheck third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-104419

Same Patch Batch · ZcashFoundation · 2026-10-02 · 18 CVEs total

CVE-2026-104422	7.5 HIGH	Zebra before 6.3.0 Block Sync Denial of Service via Coinbase scriptSig Rewrite
CVE-2026-104431	7.5 HIGH	Zebra before 6.0.0 Denial of Service via Synchronous Script FFI Verification
CVE-2026-104430	7.5 HIGH	Zebra 4.5.0 Consensus Split via P2SH Sigop Overcount
CVE-2026-104423	7.5 HIGH	Zebra before 6.2.1 Denial of Service via Uncapped V6 Shielded Proof Verification
CVE-2026-104437	7.4 HIGH	Zebra before 4.4.0 Consensus Split via SIGHASH_SINGLE Missing-Output Handling
CVE-2026-104435	7.4 HIGH	Zebra 4.4.0 Consensus Divergence via V5 SIGHASH_SINGLE Without Output
CVE-2026-104434	6.5 MEDIUM	Zebra before 8.0.0 Denial of Service via z_listunifiedreceivers RPC
CVE-2026-104426	5.9 MEDIUM	Zebra before 6.1.0 Quadratic Complexity DoS via Block Transparent Value Check
CVE-2026-104427	5.9 MEDIUM	Zebra before 6.1.0 Chain Stall via Stale parent_error_map Entry
CVE-2026-104425	5.3 MEDIUM	Zebra before 6.1.0 Batch-Verification Poisoning DoS via Unattributed Pushed Transactions
CVE-2026-104432	5.3 MEDIUM	Zebra before 6.3.0 False Readiness via Discarded One-Hash FindBlocks Response
CVE-2026-104420	5.3 MEDIUM	Zebra before 6.3.0 Peer Misbehavior Ban Bypass via Gossiped Blocks
CVE-2026-104429	5.3 MEDIUM	Zebra before 6.0.0-rc.0 Per-Peer Mempool Admission Bypass via P2P tx Messages
CVE-2026-104421	5.3 MEDIUM	Zebra before 6.2.1 Block Download Denial of Service via KnownBlock SentHashes Lockout
CVE-2026-104428	5.3 MEDIUM	Zebra before 11.0.0 Denial of Service via getblock Verbosity 2
CVE-2026-104436	3.7 LOW	Zebra before 4.5.0 CPU Amplification via Uncapped getblocks/getheaders Locator Length
CVE-2026-104424	3.7 LOW	Zebra before 6.1.0 Incorrect Block Size Calculation in getblocktemplate

IV. Related Vulnerabilities

Same product: zebra

Same vendor: ZcashFoundation

Same weakness: CWE-345

V. Comments for CVE-2026-104419

No comments yet

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2026-104419— Zebra before 6.3.0 Honest Peer Banning via Far-Ahead FindBlocks Hashes

Quick assessment

Possible ATT&CK Techniques 1 AI

Affected Version Matrix 2

I. Basic Information for CVE-2026-104419

Vulnerability Information

Vulnerability Title

Vulnerability Description

CVSS Information

Vulnerability Type

Affected Products

II. Public POCs for CVE-2026-104419

III. Intelligence Information for CVE-2026-104419

Vendor Advisories for CVE-2026-104419 (1)

Other References for CVE-2026-104419 (1)

Same Patch Batch · ZcashFoundation · 2026-10-02 · 18 CVEs total

IV. Related Vulnerabilities

V. Comments for CVE-2026-104419

Leave a comment