Zebra before 6.2.1 Incomplete Cleanup Flaw

Executive Summary

CVE-2026-104421 is a vulnerability in Zebra, a Rust implementation of the Zcash node software, affecting versions prior to 6.2.1. The issue involves 'poisoned blocks' that delay the download of valid blocks by exploiting a lockout mechanism in the KnownBlock path. An attacker sends a contextually invalid block with the same header hash as a valid block, causing Zebra to reject it but leave a stale entry in the SentHashes list. This prevents the node from downloading the honest block, keeping it one block behind the network tip.

Useful 0 Not Useful 0

Detection Guidance

Check Zebra version with 'zebrad --version'. If running version below 6.2.1, the system is vulnerable. Monitor node logs for repeated block rejection events or peers sending blocks with mismatched contexts but same header hashes.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows unauthenticated peers to perform a Denial of Service (DoS) attack by blocking the download of valid blocks. Nodes may become stuck behind the blockchain tip, delaying synchronization with the network. The impact is bounded as the affected state is in memory and clears on restart, but it can persist until the node restarts or unrelated commit activity occurs.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability primarily causes a Denial of Service (DoS) by preventing nodes from downloading valid blocks, which could disrupt blockchain operations. It does not directly impact data privacy or security controls required by GDPR or HIPAA. However, prolonged downtime or service disruption might indirectly affect compliance with availability requirements in these regulations.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Zebra to version 6.2.1 or later. Alternatively, restart the Zebra node to clear the in-memory SentHashes list. Ensure all peers are running patched versions to prevent exploitation.

Useful 0 Not Useful 0