CVE-2026-123557 · Package
NO FIX YET · SEE WHAT TO DO
Zebra's zebrad node before 7.0.0 has a reachable assertion race condition. An unauthenticated remote peer can make a syncing node abort by sending empty FindBlocks or FindHeaders replies and stopping reads on its socket.
first public Oct 22, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Teams that run a Zebra zebrad node that accepts inbound peer connections while syncing. Any node reachable from untrusted peers can be affected; nodes that only use trusted peers or are not exposed to the network are less at risk. The sources do not describe a configuration that prevents exposure.
Not affected if not-syncing, zebrad-7.0.0-or-later
Who cares self-hosted, zcash, zebra, zebrad
zebrad --version) and compare it with the fixed version in the product ranges; versions before 7.0.0 are affected.7.0.0 or later.ZcashFoundation Zebra zebrad before 7.0.0 contains a reachable assertion race condition that allows unauthenticated remote peers to abort the node by triggering disconnection during a blocked outbound send. Malicious peers can return empty FindBlocks or FindHeaders replies and stop reading their socket, dropping an unresolved MustUseClientResponseSender and terminating syncing nodes.
This page as .md · .json · CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.