CVE-2026-109366

Zebra before 6.4.0 contains an improper integrity validation vulnerability in the inbound gossip download path that allows unauthenticated peers to force dropping of new blocks without penalty. Attackers can serve a real block with a coinbase scriptSig rewritten to height 1, which keeps the ZIP-244 block hash, triggering a behind-tip drop before consensus validation and delaying tip discovery for mining backends.

CVSS 4.0

6.3CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

CVSS 3.1

3.7CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

EPSS

0.2% chance of exploitation in the next 30 days; higher than 4% of CVEs (scores of 2026-10-25)

CWE

CWE-354

Published

2026-10-12

Modified

2026-10-16

Record from

the NVD, synced 2026-10-19

References

• https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-4f6v-mj46-gxg3
• https://www.vulncheck.com/advisories/zebra-before-6.4.0-gossiped-block-drop-via-forged-coinbase-scriptsig-height

Check your stackJSON