Description
Zebra before 6.3.0 contains an improper exceptional condition check in ChainSync::obtain_tips that discards valid one-hash FindBlocks responses, falsely reporting close-to-tip status. Peers returning only the next block hash cause a zero-length sync sample, making the /ready endpoint return 200 OK while the node remains behind the tip.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| ZcashFoundation | zebra | < 6.3.0 | 6.3.0 |
References
- GitHub Security Advisory (GHSA-h8m8-844p-v3m9) vendor-advisory
- VulnCheck Advisory: Zebra before 6.3.0 False Readiness via Discarded One-Hash FindBlocks Response third-party-advisory