CVE-2026-123560 Details
Description
Zebra before 7.0.0 contains an incomplete cleanup vulnerability that allows unauthenticated peers to stall initial sync by serving a forged checkpoint block body. Attackers can supply a body with forged authorizing data near the final checkpoint, leaving rejected hashes in the sent-hash set so the node stops requesting blocks until restart.
A denial-of-service vulnerability has been identified in Zebra versions prior to 7.0.0. This vulnerability allows unauthenticated peers to disrupt the initial synchronization process by sending a forged checkpoint block body. The attackers can include fake authorizing data close to the final checkpoint, causing the node to reject the hashes and stop requesting blocks until it is restarted. The issue arises from an incomplete cleanup process that fails to remove rejected hashes from the sent-hash set, leading to a stall in synchronization.
Upgrade to Zebra version 7.0.0, which addresses this vulnerability by improving the checkpoint synchronization process and removing the exposure. There is no patched release available for the 6.4.x series.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Nov 8, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-459 | Incomplete Cleanup | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| ZcashFoundation zebrad | < 7.0.0 (semver) |
CPE
Remediation
| |
Change History
1 change record found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 8, 2026 | New CVE Received | [email protected] |