CVE-2026-104427 — Zebra before 6.1.0 Chain Stall via Stale parent_error_map Entry
Zebra before 6.1.0 contains an incomplete cleanup vulnerability in the state write task that allows remote unauthenticated peers to stall node synchronization by poisoning paren…
Published: 2026-10-02 · CVSS: 8.2 · CVSS 4.0
Zebra before 6.1.0 contains an incomplete cleanup vulnerability in the state write task that allows remote unauthenticated peers to stall node synchronization by poisoning parent_error_map. Attackers can deliver a coinbase-malleated block sharing a canonical block's hash before it propagates, causing the next canonical block to be rejected and stalling the node for roughly 2,000 blocks.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7