CVE-2026-104421 Zebra before 6.2.1 Block Download Denial of Service via KnownBlock SentHashes Lockout
Unauthenticated attackers can cause denial of service in Zcash nodes by preventing valid block downloads through hash manipulation.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-104421?
CVE-2026-104421 is a medium-severity denial of service vulnerability in ZcashFoundation zebra, published on 2 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Zebra before 6.2.1 contains an incomplete cleanup vulnerability that allows unauthenticated peers to block downloading of valid blocks by leaving rejected hashes in SentHashes. Attackers can send a contextually invalid block sharing an honest block's header hash, causing Request::KnownBlock to skip the honest block and keep nodes behind the tip.
Weakness: CWE-459
Which versions are affected by CVE-2026-104421?
How do I fix CVE-2026-104421?
No fix has been published for CVE-2026-104421 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-104421 being exploited?
There is no known exploitation of CVE-2026-104421 in the wild and no public exploit code.
Sources
Also known as GHSA-x93j-mj2f-q338, GHSA-xx63-6p6j-3wv7.