CVE-2026-123558: Security vulnerability

Published Nov 8, 2026

Updated

Zebra zebrad before 7.0.0 contains a denial of service vulnerability that allows a malicious peer to stall checkpoint sync by cancelling the verifier rewind after a failed commit. Attackers can serve a forged block with altered authorizing data plus a restart-triggering block, leaving the verifier rejecting honest blocks until restart.

Event History

Nov 8, 2026

CVE Published

via NVD·02:16 AM

Data Sourced

via NVD·02:16 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed to this issue?

Zebra zebrad versions before 7.0.0 are affected. The issue concerns checkpoint synchronization and requires interaction with a malicious peer.

What must an attacker do to trigger the denial of service?

The attacker must serve a forged block with altered authorizing data and a block that triggers a restart. This cancels the verifier rewind after a failed commit, causing the verifier to reject honest blocks until it is restarted.

How can service be restored after exploitation?

Restarting the affected zebrad instance restores its ability to accept honest blocks. Upgrading to version 7.0.0 or later addresses the affected version range.

CVE-2026-123558: Security vulnerability

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

What must an attacker do to trigger the denial of service?

How can service be restored after exploitation?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What must an attacker do to trigger the denial of service?

How can service be restored after exploitation?