Dashboard / CVE-2026-123556

CVE-2026-123556

MEDIUM
MEDIUM Priority: 0.02 BB Relevance: 74/100
Published: 2026-11-08 Modified: 2026-11-12 First seen: 2026-11-08 Status: active

Attack Surface

Network Low Complexity No Auth No Interaction

CVSS Vector Breakdown

AV: Network
AC: Low
PR: None
UI: None
S: X
AT: None
VC: None
VI: None
VA: Low

Description

ZcashFoundation Zebra from 4.5.0 before 7.0.0 contains a protection mechanism failure that bans honest peers by scoring mempool lock-time rejections at the ban threshold. Attackers can broadcast transactions locked until the current height right after each block, causing lagging nodes to ban honest relaying peers for 24 hours or until restart.

Weakness Classification (1)

Affected Software (2)

VendorProductVersion
ZcashFoundation zebra 4.5.0 < 7.0.0
ZcashFoundation zebra 4.5.0 < 7.0.0

References & Advisories (2)

Bug Bounty Relevance

74 / 100
✓ Network accessible
✓ No authentication
✓ Low complexity
✓ No user interaction

CVSS Score

6.9 / 10.0 v4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS — Exploitation Probability

0.30%
Raw Score 0.003040
Percentile 23.5%
Date 2026-11-13

EPSS Trend

2026-11-13
0.00304
2026-11-12
0.00304
2026-11-10
0.00304
2026-11-09
0.00304
2026-11-08
0.00304

Intelligence Sources

mitre ref →
nvd ref →

External Links