CVE-2026-104432 — Zebra before 6.3.0 False Readiness via Discarded One-Hash FindBlocks Response
Zebra before 6.3.0 contains an improper exceptional condition check in ChainSync::obtain_tips that discards valid one-hash FindBlocks responses, falsely reporting close-to-tip s…
Published: 2026-10-02 · CVSS: 6.9 · CVSS 4.0
Zebra before 6.3.0 contains an improper exceptional condition check in ChainSync::obtain_tips that discards valid one-hash FindBlocks responses, falsely reporting close-to-tip status. Peers returning only the next block hash cause a zero-length sync sample, making the /ready endpoint return 200 OK while the node remains behind the tip.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7