Description
ZcashFoundation Zebra zebrad before 7.0.0 contains a reachable assertion race condition that allows unauthenticated remote peers to abort the node by triggering disconnection during a blocked outbound send. Malicious peers can return empty FindBlocks or FindHeaders replies and stop reading their socket, dropping an unresolved MustUseClientResponseSender and terminating syncing nodes.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| ZcashFoundation | zebra | < 7.0.0 | 7.0.0 |
References
- GitHub Security Advisory (GHSA-6v36-c42v-v98p) vendor-advisory
- VulnCheck Advisory: Zebra zebrad before 7.0.0 Reachable Assertion DoS via Peer Disconnection third-party-advisory