Improper Integrity Validation in Zebra by Zcash Foundation
CVE-2026-109366

6.3MEDIUM

Key Information:

Vendor

Zcashfoundation

Status
Zebra
Vendor
CVE Published:
12 October 2026

What is CVE-2026-109366?

Zebra versions prior to 6.4.0 are affected by an improper integrity validation issue in the inbound gossip download path. This vulnerability allows unauthenticated peers to manipulate block acceptance, leading to potential disruptions in blockchain consensus by forcing the premature rejection of valid blocks. Attackers can exploit this flaw by providing a legitimate block with a modified coinbase scriptSig set to height 1, which retains the ZIP-244 block hash. This manipulation can severely delay the discovery of the latest blocks, hindering the efficiency of mining operations.

Affected Version(s)

zebra 0 < 6.4.0

zebra 6.4.0

References

https://github.com/ZcashFoundation/zebra/security/advisor...
vendor-advisory
https://www.vulncheck.com/advisories/zebra-before-6.4.0-g...
third-party-advisory

CVSS V4

Score:
6.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

craftsoldier
arya2
conradoplg
mpguerra
.