CVE-2026-52737

Name of the Vulnerable Software and Affected Versions ZEBRA versions prior to 4.4.2

Description A malicious unauthenticated P2P peer can degrade the synchronization of a Zcash node by responding to outbound getblocks or FindBlocks requests with a small two-hash inventory and a syntactically valid block whose coinbase height is significantly above the local chain tip. This triggers a BlockDownloadVerifyError::AboveLookaheadHeightLimit error in the zebrad/src/components/sync/downloads.rs file. Because this error originally lacked the advertiser peer address, the handle block response function could not attribute the failure to the specific peer. Consequently, the error triggered a global sync restart in zebrad/src/components/sync.rs, cancelling all active downloads from honest peers and imposing a 67-second delay on the mainnet. Since the malicious peer was neither scored nor disconnected, the attack could be repeated indefinitely with minimal bandwidth. Additionally, several other pre-consensus sync-layer errors, such as InvalidDifficultyThreshold, TimeTooEarly, TimeTooLate, and NonSequentialBlock, previously had zero misbehaviour scores, allowing for repeated abuse without penalty.

Recommendations Update ZEBRA to version 4.4.2 or later.