PT-2026-139838

CVE-2026-123557

Published

2026-11-08

Updated

2026-11-08

Description by

CVSS 4.0

8.2

High

MetricsAV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions ZcashFoundation Zebra zebrad versions prior to 7.0.0

Description A reachable assertion race condition exists that allows unauthenticated remote peers to abort the node. This occurs when a disconnection is triggered during a blocked outbound send. Malicious peers can achieve this by returning empty FindBlocks or FindHeaders replies and stopping their socket reading, which drops an unresolved MustUseClientResponseSender and terminates syncing nodes.

Recommendations Update ZcashFoundation Zebra zebrad to version 7.0.0 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Vendors

Affected products

Weakness enumeration

CWE-617: Reachable Assertion

Related identifiers

CVE-2026-123557