What’s Vulnerable › Vulnerabilities

CVE-2026-104422: Zebra before 6.3.0 Block Sync Denial of Service via Coinbase scriptSig Rewrite

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-02 · updated 2026-10-02
• Weakness: CWE-345

Description

The block sync download path in Zebra (zebrad) before 6.3.0 reads a block's height from its unvalidated coinbase scriptSig and drops blocks that appear too far behind the tip before consensus validation, without penalizing the supplying peer. Because V5 transaction IDs exclude the scriptSig, a malicious peer can repeatedly serve a canonical block whose coinbase claims height 1 while keeping the requested hash, delaying the node's discovery of the newest block.

Affected products

• ZcashFoundation zebra: before 6.3.0 — fixed in 6.3.0

How to fix

Upgrade to a fixed version: ZcashFoundation zebra 6.3.0. Check the vendor advisory for mitigations.

References

• https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-g95h-hw6g-pvgv
• https://www.vulncheck.com/advisories/zebra-before-6.3.0-block-sync-denial-of-service-via-coinbase-scriptsig-rewrite

Get alerted when CVE-2026-104422 or the next vulnerability affects your stack