high · CVSS v3 7.5 · CVSS v4 8.7

CVE-2026-123558

Zebra zebrad before 7.0.0 is vulnerable to a denial‑of‑service that can be triggered by a malicious peer during checkpoint synchronization.

Overview

Zebra zebrad before 7.0.0 is vulnerable to a denial‑of‑service that can be triggered by a malicious peer during checkpoint synchronization. By cancelling the verifier rewind after a failed commit, an attacker can cause the node to reject legitimate blocks until it is restarted. This disrupts network availability and can stall consensus.

Description

Zebra zebrad before 7.0.0 contains a denial of service vulnerability that allows a malicious peer to stall checkpoint sync by cancelling the verifier rewind after a failed commit. Attackers can serve a forged block with altered authorizing data plus a restart-triggering block, leaving the verifier rejecting honest blocks until restart.

Impact

The vulnerability compromises Availability, causing nodes to become unresponsive to new blocks until a restart. Network operators and blockchain participants are directly impacted, as consensus stalls and transaction processing is halted.

Remediation

Apply the official patch that upgrades zebrad to version 7.0.0 or later. If an upgrade is not immediately possible, restrict peer connections to trusted nodes, monitor for abnormal block patterns, and consider temporarily disabling checkpoint sync until a fix is applied. Additionally, implement firewall rules to block peers that repeatedly send malformed blocks.

Risk context

Severity is high with CVSS v3 score 7.5 and CVSS v4 score 8.7. The lack of EPSS data suggests a moderate to high likelihood of exploitation in active networks. Defenders should treat this as a high‑priority issue and act promptly.

Affected products

  • Zebra zebrad

Scores

Severity
high
CVSS v2
7.8
CVSS v3
7.5
CVSS v4
8.7
EPSS
—

denial-of-service checkpoint-sync Zebra blockchain high-severity

← All CVEs

Related CVEs

high

CVE-2026-123512

Vikunja versions prior to 2.7.1 expose password-reset, email-confirmation, and account-deletion tokens in URLs that are logged, allowing attackers with log access to replay tokens and compromise accounts. This flaw can lead to unauthorized account takeover or deletion. Defenders should update or patch the application immediately.

View analysis

high

CVE-2026-123513

Vikunja before 2.7.1 contains a credential exposure vulnerability that allows attackers to steal stored auth tokens by inducing users to switch the frontend API URL. Because checkAndSetApiUrl leaves origin-independent localStorage tokens in place, the bearer token and desktop OAuth refresh token are sent to the attacker's server, enabling account takeover.

View analysis

high

CVE-2026-123516

Vikunja before 2.7.1 contains a resource exhaustion vulnerability in the vikunja-file ZIP importer that allows authenticated users to consume CPU and memory by uploading archives with excessive entries. Attackers can upload export ZIPs containing many empty or non-files/ entries that bypass the per-entry caps, forcing scanArchive to process every entry twice.

View analysis

high

CVE-2026-123517

Vikunja before 2.7.1 contains an information disclosure vulnerability that allows authenticated users to determine whether private teams exist by calling the team member self-removal endpoint. Attackers can send DELETE requests to /teams/{id}/members/{own username} for arbitrary team ids and use the distinguishable responses to learn if a team exists, is SSO-managed, or has a single member.

View analysis