CVE-2026-123557 Details

A denial-of-service vulnerability has been identified in Zcash Foundation's Zebra zebrad versions prior to 7.0.0. This issue arises from a reachable assertion race condition that allows unauthenticated remote peers to cause the node to abort. The vulnerability is triggered by disconnecting a peer during a blocked outbound message send, which drops an unresolved response handle and leads to a process termination. Malicious peers can exploit this by sending empty replies to block or header discovery requests, halting socket reading, and causing syncing nodes to crash.

Upgrade to Zcash Foundation Zebra version 7.0.0 or later, which addresses the vulnerability by ensuring that the connection owns the response sender for the entire duration of the send. If an outbound send is canceled, the sender is resolved with an error, preventing the assertion from being triggered. Additionally, consider using a process supervisor with automatic restart capabilities to minimize downtime.