CVE-2026-104420

Zebra before 6.3.0 contains a protection mechanism failure that allows unauthenticated peers to evade misbehavior scoring by supplying invalid gossiped blocks. The inbound cleanup step wrongly downcasts RouterError to VerifyBlockError and discards the score, so attackers can repeatedly force bloc...

CVE-2026-104420 Zebra before 6.3.0 Peer Misbehavior Ban Bypass via Gossiped Blocks

Zebra before 6.3.0 contains a protection mechanism failure that allows unauthenticated peers to evade misbehavior scoring by supplying invalid gossiped blocks. The inbound cleanup step wrongly downcasts RouterError to VerifyBlockError and discards the score, so attackers can repeatedly force bloc...

EUVD-2026-91431

Zebra before 6.3.0 contains a protection mechanism failure that allows unauthenticated peers to evade misbehavior scoring by supplying invalid gossiped blocks. The inbound cleanup step wrongly downcasts RouterError to VerifyBlockError and discards the score, so attackers can repeatedly force bloc...

CVE-2026-104420

The Zebra software (versions before 6.3.0 ) contains a protection mechanism failure that allows unauthenticated peers to evade misbehavior scoring. The vulnerability occurs during an inbound cleanup step where the system wrongly downcasts RouterError to VerifyBlockError , causing the associated s...

CVE-2026-104420 Zebra before 6.3.0 Peer Misbehavior Ban Bypass via Gossiped Blocks

Zebra before 6.3.0 contains a protection mechanism failure that allows unauthenticated peers to evade misbehavior scoring by supplying invalid gossiped blocks. The inbound cleanup step wrongly downcasts RouterError to VerifyBlockError and discards the score, so attackers can repeatedly force bloc...

CVE-2026-104420: Incorrect Type Conversion or Cast

Zebra before 6.3.0 contains a protection mechanism failure that allows unauthenticated peers to evade misbehavior scoring by supplying invalid gossiped blocks. The inbound cleanup step wrongly downcasts RouterError to VerifyBlockError and discards the score, so attackers can repeatedly force bloc...

PT-2026-104231

Zebra before 6.3.0 contains a protection mechanism failure that allows unauthenticated peers to evade misbehavior scoring by supplying invalid gossiped blocks. The inbound cleanup step wrongly downcasts RouterError to VerifyBlockError and discards the score, so attackers can repeatedly force bloc...

Rocky Linux 8 [CIQ] Security Update: gssdp / gssdp-debuginfo / gssdp-debugsource / gssdp-devel / etc (crlsa-2021_1789)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20211789 advisory. hostapd: UPnP SUBSCRIBE misbehavior in WPS AP CVE-2020-12695 Tenable has extracted the preceding description block directly from the CIQ security advisory. Note tha...

CentOS Linux 8 [TuxCare] Security Update: expat / expat-devel / expat-static Multiple Vulnerabilities (CENTOS-STREAM8:CLSA-2026:1773928447)

The CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS-STREAM8:CLSA-2026:1773928447 advisory. - In Expat aka libexpat before 2.4.3, a left shift by 29 or more places in the storeAtts function in xmlparse.c can lead to reall...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: firefox (UTSA-2023-002133)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2023-002133 advisory. In Expat aka libexpat before 2.4.3, a left shift by 29 or more places in the storeAtts function in xmlparse.c can lead to realloc misbehavior e.g., allocating too fe...

Astra Linux – Vulnerabilities in Firefox, Thunderbird, and Expat

In Expat also known as libexpat, before version 2.4.3, a left shift of 29 or more in the storeAtts function in xmlparse.c could lead to improper realloc behavior. This could result in allocating too few bytes, or only freeing memory after it was no longer needed...

SUSE CVE-2026-89577

In the Linux kernel, the following vulnerability has been resolved: dm-io: report non-retryable errors separatedly The error codes BLKSTSNOTSUPP and BLKSTSINVAL should not cause leg failure on dm-raid1. This patch changes the interface to dm-io, so that it reports two error bitmaps - errorbits an...

CVE-2026-53706: Incorrect Calculation

PREVAIL is a Polynomial-Runtime EBPF Verifier using an Abstract Interpretation Layer. Prior to version 0.2.4, the prevail eBPF verifier accepts ALU32 ADD and SUB instructions that operate on pointer-typed registers without checking the is64 flag. Because ALU32 arithmetic zero-extends the 32-bit...

CVE-2026-52829

ZEBRA is a Zcash node written entirely in Rust. Prior to 4.5.0, an unauthenticated IPv4 peer can deterministically terminate a synced Zebra node using the default Linux dual-stack listener configuration. The handshake path canonicalized an IPv4-mapped IPv6 PeerSocketAddr such as ::ffff:127.0.0.1 ...

CVE-2026-52829 ZEBRA: IPv4-Mapped Mempool Misbehavior Update Aborts Zebra Address Book

ZEBRA is a Zcash node written entirely in Rust. Prior to 4.5.0, an unauthenticated IPv4 peer can deterministically terminate a synced Zebra node using the default Linux dual-stack listener configuration. The handshake path canonicalized an IPv4-mapped IPv6 PeerSocketAddr such as ::ffff:127.0.0.1 ...

MAL-2026-12086 Malicious code in @wethenorth12/bip39-mnemonic (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d0b607f30d6abb6d568a9a52ff027cea51c7a1efccc54c2fa59a8acc2d6f0386 On require of the package's main entrypoint, the module collects hostname, username, home directory, platform, cwd, and the entire process.env,...

CVE-2026-48588

An issue was discovered in Django 6.0 before 6.0.7 and 5.2 before 5.2.16. UpdateCacheMiddleware and the cachepage decorator cache responses that vary on cookies when the incoming request carries unrelated cookies, which allows remote attackers to read private data from the shared cache. Earlier,...

GHSA-63WG-WJJJ-7CP8 Zebra Address Book Aborted by IPv4-Mapped Mempool Misbehavior Update

Am I affected You are affected if: 1. You run zebrad up to and including v4.4.1. 2. Your node listens on the default :: address on a Linux host the standard deployment configuration — net.ipv6.bindv6only=0 is the default on all common Linux distributions. 3. Your node is synced near the chain tip...

Zebra Address Book Aborted by IPv4-Mapped Mempool Misbehavior Update

Am I affected You are affected if: 1. You run zebrad up to and including v4.4.1. 2. Your node listens on the default :: address on a Linux host the standard deployment configuration — net.ipv6.bindv6only=0 is the default on all common Linux distributions. 3. Your node is synced near the chain tip...

GHSA-4FC2-H7JH-287C zebrad has mempool transaction admission denial via single-peer inbound queue saturation

Am I affected You are affected if: 1. You run zebrad up to and including v4.4.1. 2. Your node accepts inbound P2P connections network.listenaddr is set, which is the default. 3. Your node's mempool is active node is synced near the chain tip. All default configurations are affected. Summary A...