CVE-2026-123560: Security vulnerability

Published Nov 8, 2026

Updated

Zebra before 7.0.0 contains an incomplete cleanup vulnerability that allows unauthenticated peers to stall initial sync by serving a forged checkpoint block body. Attackers can supply a body with forged authorizing data near the final checkpoint, leaving rejected hashes in the sent-hash set so the node stops requesting blocks until restart.

Event History

Nov 8, 2026

CVE Published

via NVD·02:16 AM

Data Sourced

via NVD·02:16 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Which nodes are exposed to this issue?

Zebra nodes running a version before 7.0.0 are exposed during initial synchronization. The attack is performed by an unauthenticated peer supplying a forged checkpoint block body.

What does an attacker need to do to trigger the denial of service?

The attacker needs to serve a forged checkpoint block body containing forged authorizing data near the final checkpoint. This leaves rejected hashes in the node's sent-hash set, preventing it from requesting additional blocks.

What is the operational impact and immediate recovery action?

The affected node can stop progressing through initial sync until it is restarted. Restarting the node restores block requests, but does not remove exposure on an unpatched version.

CVE-2026-123560: Security vulnerability

Event History

Frequently Asked Questions

Which nodes are exposed to this issue?

What does an attacker need to do to trigger the denial of service?

What is the operational impact and immediate recovery action?

Company

Resources

Contact

Frequently Asked Questions

Which nodes are exposed to this issue?

What does an attacker need to do to trigger the denial of service?

What is the operational impact and immediate recovery action?