CVE-2026-123557

EUVD-2026-119442
ZcashFoundation Zebra zebrad before 7.0.0 contains a reachable assertion race condition that allows unauthenticated remote peers to abort the node by triggering disconnection during a blocked outbound send. Malicious peers can return empty FindBlocks or FindHeaders replies and stop reading their socket, dropping an unresolved MustUseClientResponseSender and terminating syncing nodes.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
5.9 MEDIUM
NETWORK
HIGH
NONE
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: 23.79%
Common Weakness Enumeration
References
https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-6v36-c42v-v98p
https://www.vulncheck.com/advisories/zebra-zebrad-before-7.0.0-reachable-assertion-dos-via-peer-disconnection