CVE-2026-123557
📛 CVE Title
Zebra zebrad before 7.0.0 Reachable Assertion DoS via Peer Disconnection
Description
ZcashFoundation Zebra zebrad before 7.0.0 contains a reachable assertion race condition that allows unauthenticated remote peers to abort the node by triggering disconnection during a blocked outbound send. Malicious peers can return empty FindBlocks or FindHeaders replies and stop reading their socket, dropping an unresolved MustUseClientResponseSender and terminating syncing nodes.
Overview
- State
- PUBLISHED
- Assigner (CNA)
- VulnCheck
- CVSS severity
- HIGH
- CVSS score
- 8.2 / 10
- CVSS vector
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N- Effective score
- 8.2 / 10 HIGH source: CNA overview
- CWE(s)
-
CWE-617 - Reserved
- 2026-11-06
- Published
- 2026-11-08 01:37 UTC
- Last updated
- 2026-11-08 01:37 UTC
- Source
- https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/123xxx/CVE-2026-123557.json
- Linked Threat
- CVE-2026-123557 — Zebra zebrad before 7.0.0 Reachable Assertion DoS via Peer Disconnection
European Union Vulnerability Database ENISA EUVD
ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.
- EUVD ID
-
EUVD-2026-119442
EUVD enrichment is queued; refresh the page in a few seconds.
Affected products (1)
| Vendor | Product | Versions | Platforms |
|---|---|---|---|
| ZcashFoundation | zebra |
0 (affected),
7.0.0 (unaffected)
|
— |
Vendor references (2)
References embedded in the original CVE record by the assigning CNA.
- GitHub Security Advisory (GHSA-6v36-c42v-v98p) vendor-advisory
- VulnCheck Advisory: Zebra zebrad before 7.0.0 Reachable Assertion DoS via Peer Disconnection third-party-advisory
Web references (0)
DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.
No web references attached yet.
Remediations (10)
Remediations are stored against the linked Threat row; the list below is deduplicated across both pages.
-
web:blog.it-learn.io
Ivanti patches CVE - 2026 -111357 and CVE - 2026 -118527 zero-day chain exploited since October. Chinese APT weaponizes ARTEX AI framework against 200+ orgs.
2026-11-08 10:24 UTC -
web:cybersecuretoday.com
Python has added a denylist for known compromised Vulnerability Disclosed CVE - 2026 -115557 in Python has added a denylist for known compromised (Security Vulnerability) allows remote attackers to trigger arbitrary code execution.
2026-11-08 10:24 UTC -
web:docs.netscaler.com
NetScaler detects CVEs and provides remediation suggestions the same. This topic lists the remediations suggested for the following CVEs :
2026-11-08 10:24 UTC -
web:sec.cloudapps.cisco.com
As part of Cisco's ongoing commitment to proactive security and product quality, engineering teams conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. These vulnerabilities were found during internal testing and are not known to be actively exploited. To assist customers in patching ...
2026-11-08 10:24 UTC -
web:support.sap.com
On 13 th of October 2026 , SAP security patch day saw the release of 16 new security notes and 4 GitHub security advisories. There are 2 updates to previously released security notes.
2026-11-08 10:24 UTC -
web:www.aikido.dev
CVE remediation is fixing known flaws in the software you run. Why upgrading often fails, what remediation actually involves, and how backporting fixes it.
2026-11-08 10:24 UTC -
web:www.openhands.dev
Compare 8 automated vulnerability remediation tools for 2026 on fixes, prioritization, integrations, and deployment control.
2026-11-08 10:24 UTC -
web:www.oracle.com
This Critical Patch Update contains 1295 new security patches across the product families listed below. Please note that a My Oracle Support (MOS) note summarizing the content of this Critical Patch Update and other Oracle Software Security Assurance activities is located at October 2026 Critical Patch Update: Executive Summary and Analysis.
2026-11-08 10:24 UTC -
web:www.sammyfans.com
Samsung has published the October 2026 Security Maintenance Release notes, and the package leans heavily on Google's work this month. Nine critical-rated Android vulnerabilities are covered, headlined by CVE - 2026 -20519 and CVE - 2026 -20520, alongside 33 high-severity fixes and three moderate ones. Nothing in the low category this time. Samsung also flagged a few housekeeping items. Three CVEs […]
2026-11-08 10:24 UTC -
web:www.unihosted.com
Recently, Ubiquiti released Security Advisory Bulletin 062, an urgent disclosure. The bulletin revealed three severe vulnerabilities deep within the architecture of the UniFi Network Application, the central management console used to orchestrate access points, switches, and security gateways across multi-tenant environments. The most critical of these flaws, officially tracked as CVE-2026 ...
2026-11-08 10:24 UTC
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.
Raw JSON
The full cvelistV5 record. Download as CVE-2026-123557.json.
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:cargo/zebrad",
"product": "zebra",
"vendor": "ZcashFoundation",
"versions": [
{
"lessThan": "7.0.0",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "7.0.0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:zfnd:zebra:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "SphereDonout"
},
{
"lang": "en",
"type": "remediation developer",
"value": "conradoplg"
},
{
"lang": "en",
"type": "coordinator",
"value": "mpguerra"
}
],
"datePublic": "2026-10-22T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "ZcashFoundation Zebra zebrad before 7.0.0 contains a reachable assertion race condition that allows unauthenticated remote peers to abort the node by triggering disconnection during a blocked outbound send. Malicious peers can return empty FindBlocks or FindHeaders replies and stop reading their socket, dropping an unresolved MustUseClientResponseSender and terminating syncing nodes."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-617",
"description": "Reachable Assertion",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-08T01:37:58.967Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-6v36-c42v-v98p)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-6v36-c42v-v98p"
},
{
"name": "VulnCheck Advisory: Zebra zebrad before 7.0.0 Reachable Assertion DoS via Peer Disconnection",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/zebra-zebrad-before-7.0.0-reachable-assertion-dos-via-peer-disconnection"
}
],
"title": "Zebra zebrad before 7.0.0 Reachable Assertion DoS via Peer Disconnection",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-123557",
"datePublished": "2026-11-08T01:37:58.967Z",
"dateReserved": "2026-11-06T00:50:45.483Z",
"dateUpdated": "2026-11-08T01:37:58.967Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}