NRDAX-T0295 - Sync-State Poisoning Via Fake Blocks

gossip_abuse · active · first seen 2024-01-01

provenance: Reproduced in NullRabbit's attack-reproduction pipeline

mechanism

CVE-2026-52737 (GHSA-gvjc-3w7c-92jx): a single unauthenticated Zcash P2P peer answers the syncing node's getblocks/FindBlocks with a two-hash inv, then serves a `block` whose coinbase height is above

instances (1)

chain	primitive	fidelity	origin	reproducer (bundle)	source
zcash	zebra_sync_restart_poisoning	lab	reverse-engineered-cve	zebra_sync_restart_poisoning	CVE-2026-52737 / GHSA-gvjc-3w7c-92jx — https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-gvjc-3w7c-92jx

references

cve: CVE-2024-52921

cve: CVE-2025-24371

cve: CVE-2026-52736

cve: CVE-2026-52737

ghsa: GHSA-r3r4-g7hq-pq4f

ghsa: GHSA-rpcw-q5mr-gq35

vendor-advisory: GHPR-cometbft-cometbft-5803

vendor-advisory: GHREL-near-nearcore-1.18.1

vendor-advisory: GHREL-near-nearcore-1.18.1-rc.3

vendor-advisory: GHREL-near-nearcore-1.22.0-rc.3

related (gossip_abuse)

NRDAX-T0001 - Addr Message Counter Overflow Crash active NRDAX-T0050 - DHT Sybil Content Censorship active NRDAX-T0120 - Integer-Overflow Panic Control Message active NRDAX-T0188 - Oversized Control-Message Array CPU Burn active NRDAX-T0192 - Oversized Transaction Block-Fill active NRDAX-T0199 - Peer-Record Flood OOM active NRDAX-T0312 - Tx-Relay Throughput Jamming active NRDAX-T0326 - Unbounded Peer-Slot Sybil active

cite

https://nrdax.com/techniques/NRDAX-T0295

plain

NRDAX Registry. Technique NRDAX-T0295.

bibtex

@misc{nrdax_NRDAX_T0295,
  title = {Sync-State Poisoning Via Fake Blocks (NRDAX-T0295)},
  howpublished = {NRDAX Registry},
  url = {https://nrdax.com/techniques/NRDAX-T0295},
}

json (csl)

{
  "id": "nrdax-NRDAX-T0295",
  "type": "dataset",
  "title": "Sync-State Poisoning Via Fake Blocks (NRDAX-T0295)",
  "URL": "https://nrdax.com/techniques/NRDAX-T0295",
  "publisher": "NRDAX Registry"
}