{"id":"CVE-2026-123556","kind":"vulnerability","aliases":["CVE-2026-123556"],"related":[],"title":"Zebra: lock-time rejections ban honest peers for 24 hours","description":"ZcashFoundation Zebra from 4.5.0 before 7.0.0 contains a protection mechanism failure that bans honest peers by scoring mempool lock-time rejections at the ban threshold. Attackers can broadcast transactions locked until the current height right after each block, causing lagging nodes to ban honest relaying peers for 24 hours or until restart.","summary":"Zebra, a Zcash node implementation, scores mempool lock-time rejections at the ban threshold, so honest relaying peers get banned. An attacker broadcasts transactions locked to the current height right after each block, causing lagging nodes to ban good peers for 24 hours or until restart.","severity":"medium","cvss":6.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["runtime","self-hosted","zcash","zebra"],"not_affected_if":["zebra-7.0.0-or-later","zebra-below-4.5.0"],"how_to_check":"- Check the Zebra version with `zebra --version` or the release tag the node runs.\n- Look for the Zebra node in a Zcash network deployment and confirm whether it is below `7.0.0`.","fix":"- Zebra from `4.5.0` before `7.0.0`: move to `7.0.0` or later.","status":"open","published_at":"2026-11-08T02:16:47+00:00","first_seen_at":"2026-11-08T02:21:11+00:00","triaged_at":"2026-11-08T02:24:41+00:00","updated_at":"2026-11-08T02:24:41+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-11-08T02:24:41Z","model":"claude-haiku-5-5","output":{"fix":"- Zebra from `4.5.0` before `7.0.0`: move to `7.0.0` or later.","reach":"internet","title":"Zebra: lock-time rejections ban honest peers for 24 hours","impact":"low","summary":"Zebra, a Zcash node implementation, scores mempool lock-time rejections at the ban threshold, so honest relaying peers get banned. An attacker broadcasts transactions locked to the current height right after each block, causing lagging nodes to ban good peers for 24 hours or until restart.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["zebra","zcash","self-hosted"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"honest peers banned for 24 hours, degrading node connectivity","analyst_note":"","how_to_check":"- Check the Zebra version with `zebra --version` or the release tag the node runs.\n- Look for the Zebra node in a Zcash network deployment and confirm whether it is below `7.0.0`.","plain_action":"","needs_analyst":false,"not_affected_if":["zebra-below-4.5.0","zebra-7.0.0-or-later"],"who_is_affected":"Operators running Zebra nodes from 4.5.0 up to but not including 7.0.0 that accept relayed transactions from peers. Nodes that are fully synced or do not relay from the public network are less exposed. Nodes running other Zcash implementations are not described by this signal.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000706,"input_tokens":4295,"output_tokens":553,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-123556':14A,17A '-2026':13A,16A '24':10A,66B,119C '4.5.0':74C '7.0.0':76C 'attack':46B,97C 'ban':6A,37B,44B,62B,83C,95C,114C 'block':57B,109C 'broadcast':47B,99C 'caus':58B,110C 'contain':77C 'current':52B,104C 'cve':12A,15A 'failur':81C 'get':43B 'good':63B 'height':53B,105C 'honest':7A,40B,84C,115C 'host':21B 'hour':11A,67B,120C 'implement':28B 'lag':59B,111C 'lock':3A,32B,49B,90C,101C 'lock-tim':2A,31B,89C 'mechan':80C 'mempool':30B,88C 'node':27B,60B,112C 'peer':8A,42B,64B,85C,117C 'protect':79C 'reject':5A,34B,92C 'relay':41B,116C 'restart':70B,123C 'right':54B,106C 'runtim':18B 'score':29B,87C 'self':20B 'self-host':19B 'threshold':38B,96C 'time':4A,33B,91C 'transact':48B,100C 'zcash':22B,26B 'zcashfound':71C 'zebra':1A,23B,24B,72C","nicknames":[],"mitigations":[],"who_affected":"Operators running Zebra nodes from 4.5.0 up to but not including 7.0.0 that accept relayed transactions from peers. Nodes that are fully synced or do not relay from the public network are less exposed. Nodes running other Zcash implementations are not described by this signal.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["medium","runtime","selfhosted","zcash","zebra"],"campaign_type":null,"search_a":"'-123556':14A,17A '-2026':13A,16A '24':10A 'ban':6A 'cve':12A,15A 'honest':7A 'hour':11A 'lock':3A 'lock-tim':2A 'peer':8A 'reject':5A 'time':4A 'zebra':1A","search_b":"'24':66B 'attack':46B 'ban':37B,44B,62B 'block':57B 'broadcast':47B 'caus':58B 'current':52B 'get':43B 'good':63B 'height':53B 'honest':40B 'host':21B 'hour':67B 'implement':28B 'lag':59B 'lock':32B,49B 'lock-tim':31B 'mempool':30B 'node':27B,60B 'peer':42B,64B 'reject':34B 'relay':41B 'restart':70B 'right':54B 'runtim':18B 'score':29B 'self':20B 'self-host':19B 'threshold':38B 'time':33B 'transact':48B 'zcash':22B,26B 'zebra':23B,24B","search_c":"'24':119C '4.5.0':74C '7.0.0':76C 'attack':97C 'ban':83C,95C,114C 'block':109C 'broadcast':99C 'caus':110C 'contain':77C 'current':104C 'failur':81C 'height':105C 'honest':84C,115C 'hour':120C 'lag':111C 'lock':90C,101C 'lock-tim':89C 'mechan':80C 'mempool':88C 'node':112C 'peer':85C,117C 'protect':79C 'reject':92C 'relay':116C 'restart':123C 'right':106C 'score':87C 'threshold':96C 'time':91C 'transact':100C 'zcashfound':71C 'zebra':72C","first_public_at":"2026-10-22T14:46:41+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123556","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123556","severity":null,"published_at":"2026-11-08T02:16:47+00:00","modified_at":"2026-11-08T02:16:47+00:00","first_seen_at":"2026-11-08T02:21:11+00:00","fetched_at":"2026-11-08T02:21:11+00:00","note":null}],"documents":[{"id":99263,"url":"https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-5h3r-fpmj-483w","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-22T14:46:41+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":99264,"url":"https://www.vulncheck.com/advisories/zebra-4.5.0-before-7.0.0-honest-peer-ban-via-mempool-lock-time-scoring","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}