What’s Vulnerable › Vulnerabilities

CVE-2026-109366: Zebra before 6.4.0 Gossiped Block Drop via Forged Coinbase scriptSig Height

• Severity: low (CVSS 3.7 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-12 · updated 2026-10-26
• Weakness: CWE-354

Description

Zebra before 6.4.0 contains an improper integrity validation vulnerability in the inbound gossip download path that allows unauthenticated peers to force dropping of new blocks without penalty. Attackers can serve a real block with a coinbase scriptSig rewritten to height 1, which keeps the ZIP-244 block hash, triggering a behind-tip drop before consensus validation and delaying tip discovery for mining backends.

Affected products

• ZcashFoundation zebra: before 6.4.0 — fixed in 6.4.0

How to fix

Upgrade to a fixed version: ZcashFoundation zebra 6.4.0. Check the vendor advisory for mitigations.

References

• https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-4f6v-mj46-gxg3
• https://www.vulncheck.com/advisories/zebra-before-6.4.0-gossiped-block-drop-via-forged-coinbase-scriptsig-height
• https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-4f6v-mj46-gxg3

Get alerted when CVE-2026-109366 or the next vulnerability affects your stack