CVE-2026-123560

Name of the Vulnerable Software and Affected Versions Zebra versions prior to 7.0.0

Description An incomplete cleanup issue allows unauthenticated peers to stall the initial synchronization process by providing a forged checkpoint block body. By supplying a body containing forged authorizing data near the final checkpoint, attackers can leave rejected hashes within the sent-hash set, causing the node to stop requesting blocks until it is restarted.

Recommendations Update to version 7.0.0 or later.