CVE-2026-123558— Zebra before 7.0.0 Checkpoint Sync Denial of Service via Cancelled Verifier Rewind

Quick assessment

Affected

ZcashFoundation zebra

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Zebra 的在 7.0.0 版本之前存在一个拒绝服务（DoS）漏洞。恶意对等节点可以通过在提交失败后取消验证器的回滚操作，从而阻塞检查点同步过程。攻击者可以发送一个伪造的区块（其中包含被篡改的授权数据）以及一个触发重启的区块，导致验证器在重启前持续拒绝诚实区块。

CVSS 7.5 · High Updated Nov 08, 2026

Possible ATT&CK Techniques 1 AI

T1499 · Endpoint Denial of Service

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Zebra before 7.0.0 Checkpoint Sync Denial of Service via Cancelled Verifier Rewind

Source: CVE Program / CVE List V5

Vulnerability Description

Zebra zebrad before 7.0.0 contains a denial of service vulnerability that allows a malicious peer to stall checkpoint sync by cancelling the verifier rewind after a failed commit. Attackers can serve a forged block with altered authorizing data plus a restart-triggering block, leaving the verifier rejecting honest blocks until restart.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Source: CVE Program / CVE List V5

Vulnerability Type

抛出异常的清理不恰当

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
ZcashFoundation	zebra	0 ~ 7.0.0	-

II. Public POCs for CVE-2026-123558

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-123558

请登录查看更多情报信息。

Other References for CVE-2026-123558 (2)

https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-2w9f-9wx8-f5c8 vendor-advisory
https://www.vulncheck.com/advisories/zebra-before-7.0.0-checkpoint-sync-denial-of-service-via-cancelled-verifier-rewind third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-123558

Same Patch Batch · ZcashFoundation · 2026-11-08 · 7 CVEs total

CVE-2026-123555	7.5 HIGH	Zebra 2.3.0 before 7.0.0 Denial of Service via Unscored Script Verification Failures
CVE-2026-123554	7.5 HIGH	Zebra zebrad 6.4.0 before 7.0.0 Denial of Service via Mempool Coinbase-Maturity Check
CVE-2026-123560	7.5 HIGH	Zebra before 7.0.0 Sync Denial of Service via Forged Checkpoint Block Body
CVE-2026-123559	7.5 HIGH	Zebra before 7.0.0 Denial of Service via Quadratic Sighash Computation
CVE-2026-123557	5.9 MEDIUM	Zebra zebrad before 7.0.0 Reachable Assertion DoS via Peer Disconnection
CVE-2026-123556	5.3 MEDIUM	Zebra 4.5.0 before 7.0.0 Honest Peer Ban via Mempool Lock-Time Scoring

IV. Related Vulnerabilities

Same product: zebra

Same vendor: ZcashFoundation

Same weakness: CWE-460