---
id: "CVE-2026-123556"
page: "https://infrastack.ai/live/CVE-2026-123556"
kind: "vulnerability"
aliases: ["CVE-2026-123556"]
title: "Zebra: lock-time rejections ban honest peers for 24 hours"
severity: "medium"
cvss: 6.9
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["runtime", "self-hosted", "zcash", "zebra"]
not_affected_if: ["zebra-7.0.0-or-later", "zebra-below-4.5.0"]
published_at: "2026-11-08T02:16:47+00:00"
first_seen_at: "2026-11-08T02:21:11+00:00"
updated_at: "2026-11-08T02:24:41+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-123556", "first_seen_at": "2026-11-08T02:21:11+00:00"}]
exploit_sources: []
---

# Zebra: lock-time rejections ban honest peers for 24 hours

Link for people: https://infrastack.ai/live/CVE-2026-123556 (this .md is for agents)

Zebra, a Zcash node implementation, scores mempool lock-time rejections at the ban threshold, so honest relaying peers get banned. An attacker broadcasts transactions locked to the current height right after each block, causing lagging nodes to ban good peers for 24 hours or until restart.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the Zebra version with `zebra --version` or the release tag the node runs.
- Look for the Zebra node in a Zcash network deployment and confirm whether it is below `7.0.0`.

## Fix

- Zebra from `4.5.0` before `7.0.0`: move to `7.0.0` or later.

## Timeline

- 2026-11-08T02:21:11+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-123556

## Documents

- [advisory] Vendor advisory: github.com https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-5h3r-fpmj-483w
- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/zebra-4.5.0-before-7.0.0-honest-peer-ban-via-mempool-lock-time-scoring

## From the sources

ZcashFoundation Zebra from 4.5.0 before 7.0.0 contains a protection mechanism failure that bans honest peers by scoring mempool lock-time rejections at the ban threshold. Attackers can broadcast transactions locked until the current height right after each block, causing lagging nodes to ban honest relaying peers for 24 hours or until restart.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_