Zebra: Chain stall via stale parent_error_map entry
Summary
Zebra, the Zcash node implementation (zebrad), is affected before version 6.1.0. A remote, unauthenticated peer that wins the block propagation race can deliver a manipulated block with the same hash as a canonical block, which leaves a stale entry in parent_error_map and stalls the node's synchronization for roughly 2000 blocks (about 41 hours per trigger, according to the vendor). The attacker can repeat this on each new block to keep the node behind the network tip. The impact is limited to availability; there is no crash, consensus divergence or data corruption.
Affected
- Zebra (zebrad, zebra-* crates) versions before 6.1.0
- Default peer-to-peer networking configuration is affected
Fixed in
- Zebra 6.1.0 (removes the hash from parent_error_map when the canonical block commits)
- Vendor recommends the latest release, 6.3.0 or newer
Workaround
- No configuration-only workaround known.
- Restarting the node clears the stall temporarily but does not prevent re-triggering.
Exploitation
- Not known to be exploited in the wild.
- CISA SSVC: exploitation none, automatable no, technical impact partial.
- The reporter provided a proof of concept to the vendor; no public exploit repository was found.
Our recommendation
- Check whether any Zebra binary, container or lockfile (zebrad, zfnd/zebra, zebra-* crates) is in use.
- Upgrade any version below 6.1.0 to the latest release, preferably 6.3.0 or newer.
- If an immediate upgrade is not possible, monitor sync progress and restart the node if it stalls; this is a temporary measure only.
- Relevance is mainly for organisations running a Zcash full node, such as crypto services or custodians.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-8gxx-hc65-vv82 github.com
- VulnCheck advisory for CVE-2026-104427 www.vulncheck.com
- Zebra 6.1.0 release post (Zcash Foundation) zfnd.org
- Zcash Foundation Zebra releases github.com
- Zcash Foundation news feed (Zebra 6.3.0 security release) zfnd.org
- OSV entry CVE-2026-104427 osv.dev
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 17:23.
Original description (NVD)
Zebra before 6.1.0 contains an incomplete cleanup vulnerability in the state write task that allows remote unauthenticated peers to stall node synchronization by poisoning parent_error_map. Attackers can deliver a coinbase-malleated block sharing a canonical block's hash before it propagates, causing the next canonical block to be rejected and stalling the node for roughly 2,000 blocks.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.