What is GHSA-hfc4-gh7c-43q2?

GHSA-hfc4-gh7c-43q2 is a security advisory published by GitHub Security Advisories with Medium severity. Zebra before 6.3.0 contains a protection mechanism failure that allows unauthenticated peers to...

Which CVE IDs does GHSA-hfc4-gh7c-43q2 cover?

GHSA-hfc4-gh7c-43q2 covers the following CVE IDs: CVE-2026-104420. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-hfc4-gh7c-43q2?

GHSA-hfc4-gh7c-43q2 has a CVSS v3 base score of 5.3, published by GitHub Security Advisories.

GHSA-hfc4-gh7c-43q2MediumCVSS 5.3

Zebra before 6.3.0 contains a protection mechanism failure that allows unauthenticated peers to...

Vendor

GitHub Security Advisories

Published

October 2, 2026

Last Modified

October 2, 2026

🔗 CVE IDs covered (1)

CVE-2026-104420 →

📋 Description

Zebra before 6.3.0 contains a protection mechanism failure that allows unauthenticated peers to evade misbehavior scoring by supplying invalid gossiped blocks. The inbound cleanup step wrongly downcasts RouterError to VerifyBlockError and discards the score, so attackers can repeatedly force block download and Equihash verification without being banned.

🔗 References (4)

https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-8hh2-hrf2-cqf4
https://nvd.nist.gov/vuln/detail/CVE-2026-104420
https://www.vulncheck.com/advisories/zebra-before-6.3.0-peer-misbehavior-ban-bypass-via-gossiped-blocks
https://github.com/advisories/GHSA-hfc4-gh7c-43q2