Zcash Zebra CVE-2026-104419

Exploitation requires the attacker to be (or become) a connected P2P peer of a Zebra node (versions 4.5.0 up to but not including 6.3.0) that is actively in a syncing state and issuing FindBlocks requests; the attacker must serve genuine block hashes for heights more than 50,000 above the victim's current chain tip. Limiting factors: the victim must be mid-sync and well behind the chain tip (AT:P), the specific >50,000-height condition must be met, and timing/positioning so that honest peers subsequently supply those blocks is needed (AC:H), which makes reliable exploitation conditions-dependent rather than universally triggerable. No authentication beyond ordinary network peering is required (PR:N).

This is a genuine but moderate-severity peer-to-peer integrity/availability issue, not a high-urgency emergency. The vendor CVSS 4.0 vector (AV:N/AC:H/AT:P/PR:N/UI:N) scores 6.3 (Medium), and the signals are internally consistent: network-reachable (any P2P peer can trigger it) but gated behind high attack complexity (AC:H) and a specific attack requirement (AT:P) - the victim must be actively syncing and requesting blocks far ahead of its tip. Impact is limited to VI:L/VA:L (minor integrity and availability degradation via honest-peer banning and increased eclipse risk) with VC:N, so there is no confidentiality exposure. No EPSS score, CISA KEV listing, or POC is provided in the input, so exploitation likelihood cannot be quantified from the data; the absence of KEV/POC combined with AC:H/AT:P suggests this is a targeted, conditions-dependent weakness rather than a mass-exploitation threat. Note a labeling conflict: the input Tags mark this 'Information Disclosure,' which contradicts the CVSS vector (VC:N - no confidentiality impact) and the description (the real harm is honest-peer banning enabling eclipse attacks); treat the tag as erroneous.

A malicious node joins the peer set of a Zebra instance that is still syncing. When the victim issues FindBlocks requests, the attacker returns legitimate block hashes for heights more than 50,000 above the victim's tip; because Zebra discards which peer actually supplied those hashes, the victim then assigns the 100-point ban threshold to innocent honest peers that later serve those blocks, progressively evicting good peers and increasing the victim's exposure to an eclipse attack. No public exploit code is identified at time of analysis.