Block Sync Denial of Service Vulnerability in Zebra by Zcash Foundation

CVE-2026-104422

What is CVE-2026-104422?

The Zebra (zebrad) application prior to version 6.3.0 contains a vulnerability in its block sync download path. This vulnerability allows an unvalidated coinbase scriptSig to be exploited by a malicious peer, potentially leading to a denial of service. When a block’s height is derived from the coinbase scriptSig, it can drop blocks that do not appear timely enough during consensus validation. As a result, an attacker could repeatedly provide a canonical block with a coinbase that falsely claims a height of 1, preventing the node from accurately discovering newer blocks and disrupting normal network operations.

References