CVE-2026-104420

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-104420
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-104420.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-104420
Aliases
  • GHSA-8hh2-hrf2-cqf4
Published
2026-10-02T11:38:01Z
Modified
2026-10-04T02:45:48Z
Severity
  • 6.9 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N CVSS Calculator
Summary
Zebra before 6.3.0 Peer Misbehavior Ban Bypass via Gossiped Blocks
Details

Zebra before 6.3.0 contains a protection mechanism failure that allows unauthenticated peers to evade misbehavior scoring by supplying invalid gossiped blocks. The inbound cleanup step wrongly downcasts RouterError to VerifyBlockError and discards the score, so attackers can repeatedly force block download and Equihash verification without being banned.

Database specific 
{
    "cna_assigner":  "VulnCheck",
    "cwe_ids":  [
        "CWE-704"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/104xxx/CVE-2026-104420.json"
}
References

Affected packages

Git / github.com/zcashfoundation/zebra

Affected ranges

Type
GIT
Repo
https://github.com/zcashfoundation/zebra
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
f5c5277fe41eba9c74f37098738f93f35dd70d60
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "0"
        },
        {
            "fixed":  "6.3.0"
        }
    ],
    "source":  [
        "AFFECTED_FIELD",
        "DESCRIPTION"
    ]
}

Affected versions

4.*
4.3.1
tower-batch-control-v1.*
tower-batch-control-v1.1.0
tower-batch-control-v1.1.1
tower-fallback-v0.*
tower-fallback-v0.2.42
tower-fallback-v0.2.43
v1.*
v1.0.0
v1.0.0-alpha.0
v1.0.0-alpha.1
v1.0.0-alpha.10
v1.0.0-alpha.11
v1.0.0-alpha.12
v1.0.0-alpha.13
v1.0.0-alpha.14
v1.0.0-alpha.15
v1.0.0-alpha.16
v1.0.0-alpha.17
v1.0.0-alpha.18
v1.0.0-alpha.19
v1.0.0-alpha.2
v1.0.0-alpha.3
v1.0.0-alpha.4
v1.0.0-alpha.5
v1.0.0-alpha.6
v1.0.0-alpha.7
v1.0.0-alpha.8
v1.0.0-alpha.9
v1.0.0-beta.0
v1.0.0-beta.1
v1.0.0-beta.10
v1.0.0-beta.11
v1.0.0-beta.12
v1.0.0-beta.13
v1.0.0-beta.14
v1.0.0-beta.15
v1.0.0-beta.2
v1.0.0-beta.3
v1.0.0-beta.4
v1.0.0-beta.5
v1.0.0-beta.6
v1.0.0-beta.7
v1.0.0-beta.8
v1.0.0-beta.9
v1.0.0-rc.0
v1.0.0-rc.1
v1.0.0-rc.2
v1.0.0-rc.3
v1.0.0-rc.4
v1.0.0-rc.5
v1.0.0-rc.6
v1.0.0-rc.7
v1.0.0-rc.8
v1.0.0-rc.9
v1.0.1
v1.1.0
v1.2.0
v1.3.0
v1.4.0
v1.5.0
v1.5.1
v1.5.2
v1.6.0
v1.6.1
v1.7.0
v1.8.0
v1.9.0
v2.*
v2.0.0
v2.0.0-rc.0
v2.0.1
v2.1.0
v2.2.0
v2.3.0
v2.4.0
v2.4.2
v2.5.0
v3.*
v3.0.0
v3.0.0-rc.0
v3.1.0
v4.*
v4.0.0
v4.1.0
v4.2.0
v4.3.0
v4.3.1
v4.4.0
v4.4.1
v4.5.0
v4.5.1
v5.*
v5.0.0
v5.1.0
v5.1.1
v5.2.0
v6.*
v6.0.0
v6.0.0-rc.0
v6.1.0
v6.2.0
v6.2.1
v6.2.2
v6.2.3
zebra-chain-v11.*
zebra-chain-v11.1.0
zebra-chain-v11.2.0
zebra-chain-v11.3.0
zebra-consensus-v11.*
zebra-consensus-v11.0.0
zebra-consensus-v12.*
zebra-consensus-v12.0.0
zebra-consensus-v12.0.1
zebra-consensus-v13.*
zebra-consensus-v13.0.0
zebra-consensus-v14.*
zebra-consensus-v14.0.0
zebra-consensus-v14.0.1
zebra-network-v10.*
zebra-network-v10.1.0
zebra-network-v10.1.1
zebra-network-v10.2.0
zebra-network-v10.2.1
zebra-network-v11.*
zebra-network-v11.0.0
zebra-node-services-v9.*
zebra-node-services-v9.1.0
zebra-node-services-v9.1.1
zebra-node-services-v9.1.2
zebra-rpc-v11.*
zebra-rpc-v11.1.0
zebra-rpc-v12.*
zebra-rpc-v12.0.0
zebra-rpc-v13.*
zebra-rpc-v13.0.0
zebra-rpc-v14.*
zebra-rpc-v14.0.0
zebra-rpc-v15.*
zebra-rpc-v15.0.0
zebra-script-v10.*
zebra-script-v10.1.0
zebra-script-v10.1.1
zebra-script-v10.1.2
zebra-state-v10.*
zebra-state-v10.1.0
zebra-state-v11.*
zebra-state-v11.0.0
zebra-state-v11.1.0
zebra-state-v11.1.1
zebra-state-v12.*
zebra-state-v12.0.0
zebra-state-v12.0.1
zebra-utils-v10.*
zebra-utils-v10.0.0
zebra-utils-v9.*
zebra-utils-v9.1.0
zebra-utils-v9.1.1
zebra-utils-v9.1.3
zebra-utils-v9.1.4

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-104420.json"