Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-104422— Zebra before 6.3.0 Block Sync Denial of Service via Coinbase scriptSig Rewrite

Quick assessment

Affected
ZcashFoundation zebra
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 Zebra (zebrad) 6.3.0 版本之前，其区块同步下载路径会从未经过验证的 coinbase scriptSig 中读取区块高度，并在共识验证之前，直接丢弃那些看起来与当前区块链顶端（tip）距离过远的区块，且不会对提供这些区块的对等节点进行惩罚。由于 V5 版交易 ID 的计算不包含 scriptSig，恶意对等节点可以反复发送同一个规范的区块，该区块的 coinbase 声称其高度为 1，同时保持请求的哈希值不变，从而延迟该节点发现最新区块的过程。

CVSS 7.5 · High EPSS 0.18% · P7

Affected Version Matrix 2

VendorProduct Version RangeStatus
ZcashFoundation zebra < 6.3.0 affected
6.3.0 unaffected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-104422

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Zebra before 6.3.0 Block Sync Denial of Service via Coinbase scriptSig Rewrite
Source: CVE Program / CVE List V5
Vulnerability Description
The block sync download path in Zebra (zebrad) before 6.3.0 reads a block's height from its unvalidated coinbase scriptSig and drops blocks that appear too far behind the tip before consensus validation, without penalizing the supplying peer. Because V5 transaction IDs exclude the scriptSig, a malicious peer can repeatedly serve a canonical block whose coinbase claims height 1 while keeping the requested hash, delaying the node's discovery of the newest block.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
对数据真实性的验证不充分
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
ZcashFoundation zebra 0 ~ 6.3.0 -

II. Public POCs for CVE-2026-104422

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-104422

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-104422 (1)

Other References for CVE-2026-104422 (1)

Same Patch Batch · ZcashFoundation · 2026-10-02 · 18 CVEs total

CVE-2026-104423 7.5 HIGH Zebra before 6.2.1 Denial of Service via Uncapped V6 Shielded Proof Verification
CVE-2026-104430 7.5 HIGH Zebra 4.5.0 Consensus Split via P2SH Sigop Overcount
CVE-2026-104431 7.5 HIGH Zebra before 6.0.0 Denial of Service via Synchronous Script FFI Verification
CVE-2026-104435 7.4 HIGH Zebra 4.4.0 Consensus Divergence via V5 SIGHASH_SINGLE Without Output
CVE-2026-104437 7.4 HIGH Zebra before 4.4.0 Consensus Split via SIGHASH_SINGLE Missing-Output Handling
CVE-2026-104434 6.5 MEDIUM Zebra before 8.0.0 Denial of Service via z_listunifiedreceivers RPC
CVE-2026-104426 5.9 MEDIUM Zebra before 6.1.0 Quadratic Complexity DoS via Block Transparent Value Check
CVE-2026-104427 5.9 MEDIUM Zebra before 6.1.0 Chain Stall via Stale parent_error_map Entry
CVE-2026-104428 5.3 MEDIUM Zebra before 11.0.0 Denial of Service via getblock Verbosity 2
CVE-2026-104432 5.3 MEDIUM Zebra before 6.3.0 False Readiness via Discarded One-Hash FindBlocks Response
CVE-2026-104425 5.3 MEDIUM Zebra before 6.1.0 Batch-Verification Poisoning DoS via Unattributed Pushed Transactions
CVE-2026-104420 5.3 MEDIUM Zebra before 6.3.0 Peer Misbehavior Ban Bypass via Gossiped Blocks
CVE-2026-104429 5.3 MEDIUM Zebra before 6.0.0-rc.0 Per-Peer Mempool Admission Bypass via P2P tx Messages
CVE-2026-104421 5.3 MEDIUM Zebra before 6.2.1 Block Download Denial of Service via KnownBlock SentHashes Lockout
CVE-2026-104419 4.8 MEDIUM Zebra before 6.3.0 Honest Peer Banning via Far-Ahead FindBlocks Hashes
CVE-2026-104424 3.7 LOW Zebra before 6.1.0 Incorrect Block Size Calculation in getblocktemplate
CVE-2026-104436 3.7 LOW Zebra before 4.5.0 CPU Amplification via Uncapped getblocks/getheaders Locator Length

IV. Related Vulnerabilities

Same product: zebra
Same vendor: ZcashFoundation
Same weakness: CWE-345

V. Comments for CVE-2026-104422

No comments yet

Leave a comment