Zebra CVE-2025-52737: Unauthenticated Denial of Service via Sync Restart Poisoning

Vulnerability Overview Title: Sync restart poisoning from single unauthenticated peer via above-lookahead block Description: A malicious peer can trigger a global sync restart in Zebra by sending an inventory request containing two hashes, followed by a synchronized valid block whose coinbase height is significantly higher than the victim's local tip. The error is triggered in the sync download pipeline rather than being contained to the affected peer. The peer is never scored or disconnected because the error type does not carry the attacker's address. On mainnet, each successful iteration imposes a 67-second global sync restart delay. All sidechain downloads from honest peers are canceled during each restart. Impact Scope Affected Versions: - (Rust): <= 6.0.0 - (Rust): <= 4.4.1 Fixed Versions: - (Rust): 7.0.0 - (Rust): 4.5.0 CVSS v3 Base Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Confidentiality: None - Integrity: None - Availability: Low CVE ID: CVE-2025-52737 Weakness: CWE-345 Remediation Patch: Fixed in Zebra 4.4.2. The fix includes: - Carrying through the and error variants. - Making the above-lookahead and invalid height failures local (the block is discarded, and the peer is scored as 100) instead of triggering a global sync restart. - Extending to , , and to cover context verification failures that previously scored zero. Workarounds: No configuration-level workarounds are available. The attack can be mitigated by maintaining a diverse set of honest peers, but it cannot be prevented while the vulnerable code is running. Impact A single unauthenticated peer can repeatedly block a syncing Zebra node by forcing a 67-second global sync restart loop. During each restart, all associated sidechain downloads are canceled. The node does not crash, and no state is corrupted, but synchronization performance degrades significantly during the attack. References CWE-400: Uncontrolled Resource Consumption CWE-703: Improper Check or Handling of Exceptional Conditions Credits Reporter: @jpering

Goal Reached Thanks to every supporter — we hit 100%!

Zebra CVE-2025-52737: Unauthenticated Denial of Service via Sync Restart Poisoning

More from this source