Skip to content
CVE PROGRAM SOURCE RECORD6.9 Medium

CVE-2026-104432

Zebra before 6.3.0 False Readiness via Discarded One-Hash FindBlocks Response

Description

Zebra before 6.3.0 contains an improper exceptional condition check in ChainSync::obtain_tips that discards valid one-hash FindBlocks responses, falsely reporting close-to-tip status. Peers returning only the next block hash cause a zero-length sync sample, making the /ready endpoint return 200 OK while the node remains behind the tip.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

ZcashFoundation zebra

Default version status: unaffected

  • 0 to < 6.3.0affected
  • 6.3.0unaffected
pkg:cargo/Zebrad

References