CVE-2026-123557— Zebra zebrad before 7.0.0 Reachable Assertion DoS via Peer Disconnection

Quick assessment

Affected

ZcashFoundation zebra

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 7.0.0 版本之前，ZcashFoundation 的 Zebra 项目中的组件存在一个可触发的断言竞态条件漏洞。该漏洞允许未认证的远程对等节点在出站发送操作被阻塞时，通过触发断开连接来终止节点运行。恶意对等节点可以返回空的或响应，并停止读取其套接字，从而导致未解析的被丢弃，最终终止正在同步的节点。

CVSS 5.9 · Medium Updated Nov 08, 2026

Possible ATT&CK Techniques 1 AI

T1499.003 · Application Exhaustion Flood

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Zebra zebrad before 7.0.0 Reachable Assertion DoS via Peer Disconnection

Source: CVE Program / CVE List V5

Vulnerability Description

ZcashFoundation Zebra zebrad before 7.0.0 contains a reachable assertion race condition that allows unauthenticated remote peers to abort the node by triggering disconnection during a blocked outbound send. Malicious peers can return empty FindBlocks or FindHeaders replies and stop reading their socket, dropping an unresolved MustUseClientResponseSender and terminating syncing nodes.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Source: CVE Program / CVE List V5

Vulnerability Type

可达断言

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
ZcashFoundation	zebra	0 ~ 7.0.0	-

II. Public POCs for CVE-2026-123557

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-123557

请登录查看更多情报信息。

Other References for CVE-2026-123557 (2)

https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-6v36-c42v-v98p vendor-advisory
https://www.vulncheck.com/advisories/zebra-zebrad-before-7.0.0-reachable-assertion-dos-via-peer-disconnection third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-123557

Same Patch Batch · ZcashFoundation · 2026-11-08 · 7 CVEs total

CVE-2026-123555	7.5 HIGH	Zebra 2.3.0 before 7.0.0 Denial of Service via Unscored Script Verification Failures
CVE-2026-123558	7.5 HIGH	Zebra before 7.0.0 Checkpoint Sync Denial of Service via Cancelled Verifier Rewind
CVE-2026-123554	7.5 HIGH	Zebra zebrad 6.4.0 before 7.0.0 Denial of Service via Mempool Coinbase-Maturity Check
CVE-2026-123560	7.5 HIGH	Zebra before 7.0.0 Sync Denial of Service via Forged Checkpoint Block Body
CVE-2026-123559	7.5 HIGH	Zebra before 7.0.0 Denial of Service via Quadratic Sighash Computation
CVE-2026-123556	5.3 MEDIUM	Zebra 4.5.0 before 7.0.0 Honest Peer Ban via Mempool Lock-Time Scoring

IV. Related Vulnerabilities

Same product: zebra

Same vendor: ZcashFoundation

Same weakness: CWE-617