CVE-2026-104421: Zebra before 6.2.1 Block Download Denial of Service via KnownBlock SentHashes Lockout
Zebra before 6.2.1 contains an incomplete cleanup vulnerability that allows unauthenticated peers to block downloading of valid blocks by leaving rejected hashes in SentHashes. Attackers can send a contextually invalid block sharing an honest block's header hash, causing Request::KnownBlock to skip the honest block and keep nodes behind the tip.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Zcash Foundation Zebra deployments running a version before 6.2.1 are affected. The attack is performed by unauthenticated network peers, so nodes that accept peer connections are exposed.
What does an attacker need to do to trigger the denial of service?
The attacker needs to send a contextually invalid block that shares an honest block's header hash. This leaves the rejected hash in SentHashes, causing Request::KnownBlock to skip the valid block.
What is the operational impact of a successful attack?
Affected nodes can fail to download valid blocks and remain behind the chain tip. The provided severity vector indicates availability impact only, with no stated confidentiality or integrity impact.
What should operators do to remediate the issue?
Upgrade Zebra to version 6.2.1 or later. No alternative mitigation or detection method is provided in the available information.