NRDAX-T0295 - Sync-State Poisoning Via Fake Blocks

Pending classification · active · first seen 2024-01-01

Producer label: gossip_abuse. Not yet assigned a mechanism family.

provenance: Reproduced in NullRabbit's attack-reproduction pipeline

mechanism

CVE-2026-52737 (GHSA-gvjc-3w7c-92jx): a single unauthenticated Zcash P2P peer answers the syncing node's getblocks/FindBlocks with a two-hash inv, then serves a `block` whose coinbase height is above tip+VERIFICATION_PIPELINE_DROP_LIMIT. Zebra returns AboveLookaheadHeightLimit, which lacks the peer address, so it triggers a GLOBAL sync restart (~67s mainnet penalty, cancels all in-flight downloads) instead of banning the peer. Repeating the (inv -> above-lookahead block) cycle pins the node in a perpetual restart loop - sustained sync-degradation DoS from one unauth peer. Node does not crash. Affected zebrad<=4.4.1 / zebra-consensus<=6.0.0; fixed v4.5.0/7.0.0 (failures made peer-local + peer banned).

live exposure

No exposure data. Slashr ↗ has no risk signal mapped to this technique yet — absence of data is not absence of exposure.

instances (1)

chain	primitive	fidelity	origin	reproducer (bundle)	source
zcash	zebra_sync_restart_poisoning	lab	reverse-engineered-cve	zebra_sync_restart_poisoning	CVE-2026-52737 ↗

references

cve: CVE-2024-52921

cve: CVE-2025-24371

cve: CVE-2026-52736

cve: CVE-2026-52737

ghsa: GHSA-r3r4-g7hq-pq4f

ghsa: GHSA-rpcw-q5mr-gq35

vendor-advisory: GHPR-ava-labs-avalanchego-5402

vendor-advisory: GHPR-bnb-chain-bsc-3766

vendor-advisory: GHPR-cometbft-cometbft-5803

vendor-advisory: GHPR-erigontech-erigon-22907

vendor-advisory: GHPR-near-nearcore-16152

cite

https://nrdax.com/techniques/NRDAX-T0295

plain

NRDAX Registry. Technique NRDAX-T0295.

bibtex

@misc{nrdax_NRDAX_T0295,
  title = {Sync-State Poisoning Via Fake Blocks (NRDAX-T0295)},
  howpublished = {NRDAX Registry},
  url = {https://nrdax.com/techniques/NRDAX-T0295},
}

json (csl)

{
  "id": "nrdax-NRDAX-T0295",
  "type": "dataset",
  "title": "Sync-State Poisoning Via Fake Blocks (NRDAX-T0295)",
  "URL": "https://nrdax.com/techniques/NRDAX-T0295",
  "publisher": "NRDAX Registry"
}

badge

[![NRDAX-T0295 in the NRDAX registry](https://nrdax.com/badge/NRDAX-T0295.svg)](https://nrdax.com/techniques/NRDAX-T0295-sync-state-poisoning-via-fake-blocks)

use from the CLI

Retrieve or cite this technique from a script or the terminal with the NRDAX Python library & CLI.

Retrieve this technique

nrdax get NRDAX-T0295

Cite it (BibTeX)

nrdax cite NRDAX-T0295 --format bibtex

CLI guide → GitHub ↗