[ CVE-2026-104432 · Published 2 Oct 2026 ]
Vulnerability in ZcashFoundation zebra
CVSS 5.3
EPSS <1%No fix listed yet
[ Description ]Official description
Zebra before 6.3.0 contains an improper exceptional condition check in ChainSync::obtain_tips that discards valid one-hash FindBlocks responses, falsely reporting close-to-tip status. Peers returning only the next block hash cause a zero-length sync sample, making the /ready endpoint return 200 OK while the node remains behind the tip.
[ Fixes ]Fixes and patches
No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.