Medium severity5.3NVD Advisory· Published Oct 2, 2026

CVE-2026-104420

Description

Zebra before 6.3.0 contains a protection mechanism failure that allows unauthenticated peers to evade misbehavior scoring by supplying invalid gossiped blocks. The inbound cleanup step wrongly downcasts RouterError to VerifyBlockError and discards the score, so attackers can repeatedly force block download and Equihash verification without being banned.

Affected products

ZcashFoundation/Zebrallm-fuzzy
Range: <6.3.0

Patches

Vulnerability mechanics

References

github.com/ZcashFoundation/zebra/security/advisories/GHSA-8hh2-hrf2-cqf4nvd
www.vulncheck.com/advisories/zebra-before-6.3.0-peer-misbehavior-ban-bypass-via-gossiped-blocksnvd

News mentions

No linked articles in our index yet.

cvss	0.345
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000