GHSA-6v36-c42v-v98p: Zebra zebrad before 7.0.0 Reachable Assertion DoS via Peer Disconnection

Published Nov 8, 2026

Updated

ZcashFoundation Zebra zebrad before 7.0.0 contains a reachable assertion race condition that allows unauthenticated remote peers to abort the node by triggering disconnection during a blocked outbound send. Malicious peers can return empty FindBlocks or FindHeaders replies and stop reading their socket, dropping an unresolved MustUseClientResponseSender and terminating syncing nodes.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade ZcashFoundation Zebra zebrad to a version that resolves this vulnerability.
Fixed in 7.0.0

Event History

Nov 8, 2026

CVE Published

via OSV·01:37 AM

Data Sourced

via OSV·01:37 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Which nodes are realistically exposed to this issue?

Syncing zebrad nodes before 7.0.0 are exposed when they communicate with malicious remote peers. The peer does not need to authenticate.

What does an attacker need to do to trigger the denial of service?

A malicious peer can send an empty FindBlocks or FindHeaders reply, then stop reading from its socket while an outbound send is blocked. This can leave a MustUseClientResponseSender unresolved and abort the node.

What is the operational impact of successful exploitation?

The affected zebrad process terminates, causing a denial of service for the syncing node. The supplied information describes process abortion rather than data modification or remote code execution.

GHSA-6v36-c42v-v98p: Zebra zebrad before 7.0.0 Reachable Assertion DoS via Peer Disconnection

Remediation

Event History

Frequently Asked Questions

Which nodes are realistically exposed to this issue?

What does an attacker need to do to trigger the denial of service?

What is the operational impact of successful exploitation?

Company

Resources

Contact

Frequently Asked Questions

Which nodes are realistically exposed to this issue?

What does an attacker need to do to trigger the denial of service?

What is the operational impact of successful exploitation?