CVE Feed

    Dashboard / CVE / CVE-2026-109365

    CVE-2026-109365

    Zebra before 6.4.0 contains an uncontrolled resource consumption vulnerability that allows unauthenticated peers to force full proof verification by serving forged block bodies with valid header hashes. Attackers can flip authorizing-only bytes such as a coinbase scriptSig, wasting Sapling, Orchard, and Ironwood proof verification without penalty and stalling sync for 67 seconds.

    Published:Oct 12, 2026
    Last Modified:Oct 13, 2026
    EPS:Oct 12, 2026
    EPSS Score:0.0015
    CVSS Score:3.7

    Affected Products

    Vendor
    Zcashfoundation
    Product
    Zebra
    Vendor
    Zfnd
    Product
    Zebra

    Exploits

    No exploit reference

    Related CVEs

    CVE-2026-109366 (CVSS 6.3) — Zebra before 6.4.0 contains an improper integrity validation vulnerability in the inbound gossip download path…
    CVE-2026-109364 (CVSS 6.9) — Zebra 2.3.0 before 6.4.0 contains a protection mechanism failure that allows unauthenticated peers to evade ba…
    CVE-2026-109363 (CVSS 8.7) — ZcashFoundation Zebra 6.4.0 before 6.4.2 parses version 6 transactions carrying a pre-NU6.3 consensus branch I…
    CVE-2026-104437 (CVSS 8.3) — Zebra before 4.4.0 contains a consensus divergence vulnerability in V5 transparent signature verification, com…
    CVE-2026-104436 (CVSS 6.3) — Zebra before 4.5.0 contains an uncontrolled resource consumption vulnerability that allows remote P2P peers to…
    CVE-2026-104435 (CVSS 8.3) — Zebra zebrad 4.4.0 and zebra-script 6.0.0 fail to enforce a ZIP-244 consensus rule, accepting V5 transparent i…
    CVE-2026-104434 (CVSS 7.1) — ZcashFoundation Zebra zebra-rpc before 8.0.0 and zebrad before 4.5.0 contain a reachable assertion in the z_li…
    CVE-2026-104432 (CVSS 6.9) — Zebra before 6.3.0 contains an improper exceptional condition check in ChainSync::obtain_tips that discards va…
    CVE-2026-104431 (CVSS 8.7) — Zebra before 6.0.0 contains a denial of service vulnerability that allows unauthenticated peers to stall Tokio…
    CVE-2026-104430 (CVSS 8.7) — Zebra zebrad 4.5.0 and zebra-script 7.0.0 count P2SH redeem script signature operations in legacy mode rather …

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High