CVE-2026-123556— Zebra 4.5.0 before 7.0.0 Honest Peer Ban via Mempool Lock-Time Scoring

Quick assessment

Affected

ZcashFoundation zebra

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

ZcashFoundation 的 Zebra 软件在 4.5.0 至 7.0.0（不含 7.0.0）版本中存在保护机制失效漏洞。该漏洞会因对内存池（mempool）中锁时间（lock-time）交易被拒绝的情况进行评分，并达到封禁阈值，从而错误地封禁诚实的节点对等方。攻击者可在每个区块生成后，广播锁定至当前区块高度的交易，导致滞后的节点将诚实的转发对等方封禁长达 24 小时，直至其重启。

CVSS 5.3 · Medium Updated Nov 08, 2026

Possible ATT&CK Techniques 1 AI

T1498 · Network Denial of Service

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Zebra 4.5.0 before 7.0.0 Honest Peer Ban via Mempool Lock-Time Scoring

Source: CVE Program / CVE List V5

Vulnerability Description

ZcashFoundation Zebra from 4.5.0 before 7.0.0 contains a protection mechanism failure that bans honest peers by scoring mempool lock-time rejections at the ban threshold. Attackers can broadcast transactions locked until the current height right after each block, causing lagging nodes to ban honest relaying peers for 24 hours or until restart.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Source: CVE Program / CVE List V5

Vulnerability Type

保护机制失效

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
ZcashFoundation	zebra	4.5.0 ~ 7.0.0	-

II. Public POCs for CVE-2026-123556

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-123556

请登录查看更多情报信息。

Other References for CVE-2026-123556 (2)

https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-5h3r-fpmj-483w vendor-advisory
https://www.vulncheck.com/advisories/zebra-4.5.0-before-7.0.0-honest-peer-ban-via-mempool-lock-time-scoring third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-123556

Same Patch Batch · ZcashFoundation · 2026-11-08 · 7 CVEs total

CVE-2026-123555	7.5 HIGH	Zebra 2.3.0 before 7.0.0 Denial of Service via Unscored Script Verification Failures
CVE-2026-123558	7.5 HIGH	Zebra before 7.0.0 Checkpoint Sync Denial of Service via Cancelled Verifier Rewind
CVE-2026-123554	7.5 HIGH	Zebra zebrad 6.4.0 before 7.0.0 Denial of Service via Mempool Coinbase-Maturity Check
CVE-2026-123560	7.5 HIGH	Zebra before 7.0.0 Sync Denial of Service via Forged Checkpoint Block Body
CVE-2026-123559	7.5 HIGH	Zebra before 7.0.0 Denial of Service via Quadratic Sighash Computation
CVE-2026-123557	5.9 MEDIUM	Zebra zebrad before 7.0.0 Reachable Assertion DoS via Peer Disconnection

IV. Related Vulnerabilities

Same product: zebra

Same vendor: ZcashFoundation

Same weakness: CWE-693