CVE-2026-104432 PUBLISHED

Zebra before 6.3.0 False Readiness via Discarded One-Hash FindBlocks Response

Assigner: VulnCheck
Reserved: 02.10.2026 Published: 02.10.2026 Updated: 02.10.2026

Zebra before 6.3.0 contains an improper exceptional condition check in ChainSync::obtain_tips that discards valid one-hash FindBlocks responses, falsely reporting close-to-tip status. Peers returning only the next block hash cause a zero-length sync sample, making the /ready endpoint return 200 OK while the node remains behind the tip.

Metrics

CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
CVSS Score: 6.9

Product Status

Vendor ZcashFoundation
Product zebra
Versions Default: unaffected
  • affected from 0 to 6.3.0 (excl.)
  • Version 6.3.0 is unaffected

Credits

  • Maakai123 reporter
  • oxarbitrage finder

References

Problem Types

  • Improper Check for Unusual or Exceptional Conditions CWE