Is CVE-2026-123558 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-123558 being exploited in the wild.

How severe is CVE-2026-123558?

High severity, with a CVSS score of 7.5, published 8 November 2026.

Which products and versions are affected?

Zcash Foundation Zebra-Consensus before 7.0.0; Zcash Foundation Zebrad before 7.0.0.

Is there a fix for CVE-2026-123558?

Yes: fixed in 7.0.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-123558 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-123558?

Check whether you run Zcash Foundation Zebra-Consensus or Zcash Foundation Zebrad at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-123558: Zebra zebrad denial of service in checkpoint sync verification

CVE-2026-123558 · Severity: high · CVSS 7.5 · Published 2026-11-08

Zebra zebrad is a Zcash blockchain node implementation that syncs and validates transactions. A malicious peer can cause a syncing node to stall indefinitely by sending forged blocks that trigger a verification logic flaw, preventing the node from accepting valid blocks until manually restarted. This affects nodes performing initial sync or re-syncing from checkpoints, blocking blockchain participation and causing operational disruption.

Technologies: Zcash Foundation Zebrad. Vendors: Zcash Foundation.

Quick answers

Is CVE-2026-123558 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-123558 being exploited in the wild.
How severe is CVE-2026-123558?: High severity, with a CVSS score of 7.5, published 8 November 2026.
Which products and versions are affected?: Zcash Foundation Zebra-Consensus before 7.0.0; Zcash Foundation Zebrad before 7.0.0.
Is there a fix for CVE-2026-123558?: Yes: fixed in 7.0.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-123558 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-123558?: Check whether you run Zcash Foundation Zebra-Consensus or Zcash Foundation Zebrad at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 7.0.0

Technical details

The vulnerability exploits improper handling of verifier rewind cancellation during failed checkpoint commits. An attacker sends a forged block with altered authorizing data (valid under ZIP 244 but invalid in state commitment) paired with a restart-triggering block. When sync round failure occurs, the cancellable future carrying the verifier rewind is dropped, leaving the verifier permanently out of step with state and rejecting all subsequent honest blocks as already-verified or out-of-range.

Affected products

Zcash Foundation zebrad before 7.0.0
Zcash Foundation zebra-consensus before 7.0.0

Timeline

2026-10-22: disclosed
2026-11-08: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.