Is CVE-2026-104427 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-104427 being exploited in the wild.

How severe is CVE-2026-104427?

Medium severity, with a CVSS score of 5.9, published 2 October 2026.

Which products and versions are affected?

Zcash Foundation Zebra before 6.1.0.

How is CVE-2026-104427 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-104427?

Check whether you run Zcash Foundation Zebra at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-104427: Zebra incomplete cleanup in state write task

CVE-2026-104427 · Severity: medium · CVSS 5.9 · Published 2026-10-02

Zebra is a Zcash node implementation that synchronizes the blockchain from peer nodes. A flaw in its block validation logic allows remote attackers to send maliciously crafted blocks that poison the node's error tracking cache, causing the node to reject valid blocks and fall behind the network for extended periods. Restarting the node clears the issue, but attackers can repeatedly trigger this to keep nodes out of sync indefinitely.

Technologies: Zcash Foundation Zebra. Vendors: Zcash Foundation.

Quick answers

Is CVE-2026-104427 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-104427 being exploited in the wild.
How severe is CVE-2026-104427?: Medium severity, with a CVSS score of 5.9, published 2 October 2026.
Which products and versions are affected?: Zcash Foundation Zebra before 6.1.0.
Is there a fix for CVE-2026-104427?: Yes: fixed in 6.1.0. Until then: Restarting the node clears the in-memory parent_error_map and allows chain synchronization to resume, but does not prevent re-triggering of the attack. There is no configuration-only workaround.</anigation> <parameter name="timeline">[{"kind":"disclosed","at":"2026-07-17"},{"kind":"advisory","at":"2026-10-02"}] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-104427 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-104427?: Check whether you run Zcash Foundation Zebra at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 6.1.0

Restarting the node clears the in-memory parent_error_map and allows chain synchronization to resume, but does not prevent re-triggering of the attack. There is no configuration-only workaround.</anigation> <parameter name="timeline">[{"kind":"disclosed","at":"2026-07-17"},{"kind":"advisory","at":"2026-10-02"}]

Technical details

The vulnerability is an incomplete cleanup in the parent_error_map cache used during block contextual verification. When a block is rejected, its hash is inserted into the map but never removed when the canonical block at that hash later commits successfully; entries only evict via FIFO when the map exceeds 2,000 entries. An attacker can deliver a coinbase-malleated block matching a canonical block's header hash before it propagates, trigger rejection (recorded in the map), and when the canonical block arrives, it is rejected based on the stale poisoned entry without re-validation, causing chain stall for ~2,000 blocks (~41 hours). Requires winning the propagation race against honest peers.

Affected products

Zcash Foundation Zebra before 6.1.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.