Multiple Vulnerabilities in Zebra Node Affecting Syncing Process

• •Zebra nodes 2.3.0 to 6.4.2 are vulnerable to syncing disruptions.
• •Attackers can halt syncing by serving forged block bodies without proof of work.
• •Upgrade to version 7.0.0 to mitigate these vulnerabilities.

Zebra nodes running versions 2.3.0 to 6.4.2, including 7.0.0-rc.0, are vulnerable to multiple issues that can halt syncing processes. Attackers can exploit these vulnerabilities by serving forged block bodies to unauthenticated peers, causing nodes to reject genuine blocks and stop syncing. The vulnerabilities are present when nodes are syncing through checkpoint ranges at NU5 heights or lower, and the default configurations are affected. Users are advised to upgrade to version 7.0.0, which is not affected by these issues. The vulnerabilities do not lead to a chain fork or loss of funds, but they can disrupt node operations significantly. No configuration changes are required to exploit these vulnerabilities, making them particularly concerning for users running affected versions.