Quick answers
- Is CVE-2026-123556 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-123556 being exploited in the wild.
- How severe is CVE-2026-123556?
- Medium severity, with a CVSS score of 5.3, published 8 November 2026.
- Which products and versions are affected?
- Zcash Foundation Zebra 4.5.0 through 6.4.2, and 7.0.0-rc.0.
- Is there a fix for CVE-2026-123556?
- Yes: fixed in 7.0.0. Until then: Keeping the node well connected and in sync reduces how often it is one block behind a relaying peer, thereby reducing the frequency of this issue. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-123556 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-123556?
- Check whether you run Zcash Foundation Zebra at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- Fixed in: 7.0.0
Keeping the node well connected and in sync reduces how often it is one block behind a relaying peer, thereby reducing the frequency of this issue.
Technical details
The vulnerability is a protection mechanism failure (CWE-693) where Zebra assigns a peer misbehavior score equal to the ban threshold when rejecting transactions with lock-time errors. Lagging nodes (those one block behind) reject transactions that are valid at the peer's next block height but not their own, incorrectly scoring the sending peer at ban threshold. An attacker can induce this condition deliberately by broadcasting lock-time boundary transactions after each block, causing nodes to ban honest relaying peers for 24 hours (6.4.x) or until restart (4.5.0-6.3.x).
Affected products
- Zcash Foundation Zebra 4.5.0 through 6.4.2, and 7.0.0-rc.0
Timeline
- 2026-10-22: disclosed
- 2026-11-08: advisory