Intel

AIKIDO-2026-347090

zebrad is vulnerable to Denial of Service (DoS)

Denial of Service (DoS)GHSA-8gxx-hc65-vv82 Published 4 days ago

59

Medium Risk

This Affects:

RUSTzebrad
0.0.1 - 6.0.0
Fixed in 6.1.0
Are you affected? Scan for Free

TL;DR

When a block fails contextual verification Zebra records its hash in an in-memory map and propagates that failure to any child whose parent is in the map. The entry is only removed by a fixed-size limit or a restart, never when the canonical block at that hash later commits successfully. A peer can get a poisoned block sharing a canonical block's header hash rejected first, so the stale entry then blocks the canonical successor and stalls the node at that height. The fix removes the hash from the map when the canonical block at that hash commits.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range and your node accepts inbound peer-to-peer connections.

Background info

zebrad is vulnerable to Denial of Service (DoS) in versions 0.0.1 - 6.0.0.

How to fix this

Upgrade the zebrad library to the patch version.