Is CVE-2026-104421 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-104421?

CVE-2026-104421 has a CVSS v3 severity of MEDIUM (5.3).

Back

CVE-2026-104421

Description

Zebra before 6.2.1 contains an incomplete cleanup vulnerability that allows unauthenticated peers to block downloading of valid blocks by leaving rejected hashes in SentHashes. Attackers can send a contextually invalid block sharing an honest block's header hash, causing Request::KnownBlock to skip the honest block and keep nodes behind the tip.