-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

0xCERT Security Advisory 0xCERT-2026-0196
============================================================

Advisory-ID:  0xCERT-2026-0196
Severity:     High
Published:    2026-05-08T19:12:35.000Z
Updated:      2026-10-08T22:47:30.644Z
Chains:       n/a
URL:          https://www.0xcert.com/advisory/0xCERT-2026-0196

Title: Zebra has Permanent Block Discovery Halt via Gossip Queue Saturation and Syncer Poisoning

Summary
- -------
Zebra has Permanent Block Discovery Halt via Gossip Queue Saturation and Syncer Poisoning. A composite denial-of-service vulnerability in Zebra's block discovery pipeline allows an unauthenticated remote attacker to permanently halt all new block discovery on a targeted node.

Details
- -------
Summary
A composite denial-of-service vulnerability in Zebra's block discovery pipeline allows an unauthenticated remote attacker to permanently halt all new block discovery on a targeted node.

Affected
- - zebrad (rust) < 4.4.0 — fixed in 4.4.0

Severity
High (CVSS 8.7), as rated by the upstream advisory.

Recommended actions
- - Upgrade zebrad to 4.4.0 or later

Source & attribution
This 0xCERT advisory summarises GHSA-h9hm-m2xj-4rq9 / CVE-2026-44499 from the GitHub Advisory Database, credited upstream to upbqdn, mpguerra: https://github.com/advisories/GHSA-h9hm-m2xj-4rq9. Details may change; refer to the original source for the authoritative record.

References
- ----------
- - https://github.com/advisories/GHSA-h9hm-m2xj-4rq9
- - CVE-2026-44499
- - https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-h9hm-m2xj-4rq9
- - https://nvd.nist.gov/vuln/detail/CVE-2026-44499

Verify with the 0xCERT OpenPGP key: https://www.0xcert.com/pgp.asc
Fingerprint: 5F94 3ED1 1E50 CF31 2128  C493 CCC7 D9EC 9415 723D

-----BEGIN PGP SIGNATURE-----

wrsEARYKAG0FgmrI9SUJEDe9Tbcr+ZxrRRQAAAAAABwAIHNhbHRAbm90YXRp
b25zLm9wZW5wZ3Bqcy5vcmdBfxGT4lxzHb4S3Ow2Xeui9c/5iENK1GjxOWiD
nbMzQBYhBGCkkFZbJcT5QWu27ze9Tbcr+ZxrAACJLgD/fvgSpvkTu3Le7scE
qJo1CIXJFFEpaKuUh/vphgjfpwwA/0C1nb395FNVGfww1ENDH/TxY1G+vMX0
d3gILlAJ7scJ
=dZys
-----END PGP SIGNATURE-----