CVE-2026-123557
MEDIUM
NVD
CVSS Score
5.9
Severity
MEDIUM
Published
Nov 08, 2026
Vendor
unknown
Description
ZcashFoundation Zebra zebrad before 7.0.0 contains a reachable assertion race condition that allows unauthenticated remote peers to abort the node by triggering disconnection during a blocked outbound send. Malicious peers can return empty FindBlocks or FindHeaders replies and stop reading their socket, dropping an unresolved MustUseClientResponseSender and terminating syncing nodes.