Denial of Service in ZcashFoundation's Zebra 6.4.0 Affecting Node Stability
CVE-2026-109363

8.7HIGH

Key Information:

Vendor: Zcashfoundation
Status: Zebra
Vendor: CVE Published:; 12 October 2026

🔔 Create Zcashfoundation Vulnerability Alert

What is CVE-2026-109363?

The ZcashFoundation's Zebra version 6.4.0 prior to 6.4.2 is susceptible to denial of service due to improper handling of v6 transactions that carry a pre-NU6.3 consensus branch ID. An unauthenticated peer can send a crafted transaction message causing an unexpected error during size computation. This error results in a failure of zebrad, causing the node to crash. The vulnerability can be exploited repeatedly after each restart, making it crucial for users to upgrade to version 6.4.2 or later to ensure node stability.