CVE-2026-104427
Zebra before 6.1.0 contains an incomplete cleanup vulnerability in the state write task that allows…
- Risk score
- 40/100
- CVSS
- 5.9 v3.1
- Exploit chance (30 days)
- 0.3%
- Published
- 2 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- Zebra before 6.1.0 contains an incomplete cleanup vulnerability in the state write task that allows remote unauthenticated peers to stall node synchronization by poisoning parent_error_map. Attackers can deliver a coinbase-malleated block sharing a canonical block's hash before it propagates, causing the next canonica…
- Affected
- See advisory
- Fix
- Upgrade the product to 6.1.0 or later.
- Exploitation
- No known exploitation
Why it is Yellow
- CVSS 5.9 medium
References
Original description
Zebra before 6.1.0 contains an incomplete cleanup vulnerability in the state write task that allows remote unauthenticated peers to stall node synchronization by poisoning parent_error_map. Attackers can deliver a coinbase-malleated block sharing a canonical block's hash before it propagates, causing the next canonical block to be rejected and stalling the node for roughly 2,000 blocks.
Last activity 2 Oct 2026. Patch Forecast updates every hour.