CVE Feed

    Dashboard / CVE / CVE-2026-109366

    CVE-2026-109366

    Zebra before 6.4.0 contains an improper integrity validation vulnerability in the inbound gossip download path that allows unauthenticated peers to force dropping of new blocks without penalty. Attackers can serve a real block with a coinbase scriptSig rewritten to height 1, which keeps the ZIP-244 block hash, triggering a behind-tip drop before consensus validation and delaying tip discovery for mining backends.

    Published:Oct 12, 2026
    Last Modified:Oct 26, 2026
    EPS:Oct 12, 2026
    EPSS Score:0.00157
    CVSS Score:3.7

    Affected Products

    Vendor
    Zcashfoundation
    Product
    Zebra
    Vendor
    Zfnd
    Product
    Zebra

    Exploits

    No exploit reference

    Related CVEs

    CVE-2026-109365 (CVSS 6.3) — Zebra before 6.4.0 contains an uncontrolled resource consumption vulnerability that allows unauthenticated pee…
    CVE-2026-109364 (CVSS 6.9) — Zebra 2.3.0 before 6.4.0 contains a protection mechanism failure that allows unauthenticated peers to evade ba…
    CVE-2026-109363 (CVSS 8.7) — ZcashFoundation Zebra 6.4.0 before 6.4.2 parses version 6 transactions carrying a pre-NU6.3 consensus branch I…
    CVE-2026-104437 (CVSS 8.3) — Zebra before 4.4.0 contains a consensus divergence vulnerability in V5 transparent signature verification, com…
    CVE-2026-104436 (CVSS 6.3) — Zebra before 4.5.0 contains an uncontrolled resource consumption vulnerability that allows remote P2P peers to…
    CVE-2026-104435 (CVSS 8.3) — Zebra zebrad 4.4.0 and zebra-script 6.0.0 fail to enforce a ZIP-244 consensus rule, accepting V5 transparent i…
    CVE-2026-104434 (CVSS 7.1) — ZcashFoundation Zebra zebra-rpc before 8.0.0 and zebrad before 4.5.0 contain a reachable assertion in the z_li…
    CVE-2026-104432 (CVSS 6.9) — Zebra before 6.3.0 contains an improper exceptional condition check in ChainSync::obtain_tips that discards va…
    CVE-2026-104431 (CVSS 8.7) — Zebra before 6.0.0 contains a denial of service vulnerability that allows unauthenticated peers to stall Tokio…
    CVE-2026-104430 (CVSS 8.7) — Zebra zebrad 4.5.0 and zebra-script 7.0.0 count P2SH redeem script signature operations in legacy mode rather …

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High