Zebra before 6.2.1 contains an incomplete cleanup vulnerability that allows unauthenticated peers to block downloading of valid blocks by leaving rejected hashes in SentHashes. Attackers can send a contextually invalid block sharing an honest blocks header hash, causing Request::KnownBlock to skip the honest block and keep nodes behind the tip.
Weakness
The product does not properly “clean up” and remove temporary or supporting resources after they have been used.