CVE-2026-104427: Zebra before 6.1.0 Chain Stall via Stale parent_error_map Entry

Q: Which deployments are exposed?

Zcash Foundation Zebra nodes running versions before 6.1.0 are affected. The issue can be triggered by remote unauthenticated peers, so a node that accepts network peer traffic is exposed.

Q: What must an attacker do to trigger the stall?

An attacker must deliver a coinbase-malleated block that shares the hash of a canonical block before the canonical block propagates. This poisons parent_error_map, causing the next canonical block to be rejected.

Q: What is the operational impact of successful exploitation?

Successful exploitation stalls node synchronization for roughly 2,000 blocks. The provided severity vector indicates availability impact only, with no stated confidentiality or integrity impact.

Published Oct 2, 2026

Updated

Zebra before 6.1.0 contains an incomplete cleanup vulnerability in the state write task that allows remote unauthenticated peers to stall node synchronization by poisoning parenterrormap. Attackers can deliver a coinbase-malleated block sharing a canonical block's hash before it propagates, causing the next canonical block to be rejected and stalling the node for roughly 2,000 blocks.

Affected Software

1 affected component

Zcash Foundation Zebra<6.1.0

Event History

Oct 2, 2026

CVE Published

via MITRE·11:38 AM

Data Sourced

via MITRE·11:38 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·12:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed?

Zcash Foundation Zebra nodes running versions before 6.1.0 are affected. The issue can be triggered by remote unauthenticated peers, so a node that accepts network peer traffic is exposed.

What must an attacker do to trigger the stall?

An attacker must deliver a coinbase-malleated block that shares the hash of a canonical block before the canonical block propagates. This poisons parent_error_map, causing the next canonical block to be rejected.

What is the operational impact of successful exploitation?

Successful exploitation stalls node synchronization for roughly 2,000 blocks. The provided severity vector indicates availability impact only, with no stated confidentiality or integrity impact.

CVE-2026-104427: Zebra before 6.1.0 Chain Stall via Stale parent_error_map Entry

Affected Software

Event History

Frequently Asked Questions

Which deployments are exposed?

What must an attacker do to trigger the stall?

What is the operational impact of successful exploitation?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed?

What must an attacker do to trigger the stall?

What is the operational impact of successful exploitation?