CVE-2026-104427
Received Received - Intake

Incomplete Cleanup Flaw in Zebra Allows Node Synchronization Stalling

Publication date: 2026-10-02

Last updated on: 2026-10-02

Assigner: VulnCheck

Description
Zebra before 6.1.0 contains an incomplete cleanup vulnerability in the state write task that allows remote unauthenticated peers to stall node synchronization by poisoning parent_error_map. Attackers can deliver a coinbase-malleated block sharing a canonical block's hash before it propagates, causing the next canonical block to be rejected and stalling the node for roughly 2,000 blocks.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-02
Last Modified
2026-10-02
Generated
2026-10-02
AI Q&A
2026-10-02
EPSS Evaluated
N/A
NVD
CVE-2026-104427
EUVD
EUVD-2026-91438

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
zebra zebra to 6.1.0 (exc)
zebra software to 6.1.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-459 The product does not properly "clean up" and remove temporary or supporting resources after they have been used.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-104427 is a high-severity flaw in Zebra versions before 6.1.0. It involves an incomplete cleanup issue in the state write task that allows remote unauthenticated peers to stall node synchronization by manipulating the parent_error_map. Attackers can send a malformed block with the same hash as a valid block before it spreads, causing the next valid block to be rejected and halting synchronization for roughly 2,000 blocks.

Detection Guidance

To detect this vulnerability, check if your Zebra node is running a version before 6.1.0. Use the command zebra --version to verify the installed version. If the version is below 6.1.0, the node is vulnerable. Monitor node logs for repeated block rejection events or stalled synchronization, which may indicate exploitation attempts.

Impact Analysis

This vulnerability can stall your Zebra node at a specific block height for an extended period, keeping it behind the network tip. While it doesn't cause crashes or state corruption, it disrupts synchronization and may require restarting the node or upgrading to version 6.1.0 to resolve.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It primarily causes node synchronization stalls in Zebra software, which may impact network participation and data availability but does not involve unauthorized data access, processing violations, or confidentiality breaches typically addressed by these regulations.

Mitigation Strategies

Immediately upgrade to Zebra version 6.1.0 or later to patch the vulnerability. If upgrading is not possible, restart the node to clear the stale parent_error_map entries. Avoid running vulnerable versions in production environments until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-104427. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart