Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-109366— Zebra before 6.4.0 Gossiped Block Drop via Forged Coinbase scriptSig Height

Quick assessment

Affected
ZcashFoundation zebra
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Zebra 6.4.0 之前的版本中存在一个不正确的完整性验证漏洞，位于入站 gossip 下载路径中。该漏洞允许未经验证的对等节点强制丢弃新区块，且无需承担任何惩罚。攻击者可以提供一个真实的区块，但将其 coinbase scriptSig 重写为高度 1（height 1），从而保留 ZIP-244 的区块哈希。这种行为会在共识验证之前触发一个“落后于尖端（behind-tip）”的丢弃操作，从而延迟挖矿后端对新尖端（tip）的发现。

CVSS 3.7 · Low EPSS 0.16% · P4

Possible ATT&CK Techniques 1 AI

T1499 · Endpoint Denial of Service

Affected Version Matrix 2

VendorProduct Version RangeStatus
ZcashFoundation zebra < 6.4.0 affected
6.4.0 unaffected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-109366

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Zebra before 6.4.0 Gossiped Block Drop via Forged Coinbase scriptSig Height
Source: CVE Program / CVE List V5
Vulnerability Description
Zebra before 6.4.0 contains an improper integrity validation vulnerability in the inbound gossip download path that allows unauthenticated peers to force dropping of new blocks without penalty. Attackers can serve a real block with a coinbase scriptSig rewritten to height 1, which keeps the ZIP-244 block hash, triggering a behind-tip drop before consensus validation and delaying tip discovery for mining backends.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
完整性检查值验证不恰当
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
ZcashFoundation zebra 0 ~ 6.4.0 -

II. Public POCs for CVE-2026-109366

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-109366

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-109366 (2)

Same Patch Batch · ZcashFoundation · 2026-10-12 · 4 CVEs total

CVE-2026-109363 7.5 HIGH Zebra 6.4.0 before 6.4.2 Denial of Service via Malformed v6 Transaction
CVE-2026-109364 5.3 MEDIUM Zebra 2.3.0 before 6.4.0 Peer Ban Bypass via Exact-IP Keying
CVE-2026-109365 3.7 LOW Zebra before 6.4.0 Denial of Service via Same-Hash Forged Block Bodies

IV. Related Vulnerabilities

Same product: zebra
Same vendor: ZcashFoundation
Same weakness: CWE-354

V. Comments for CVE-2026-109366

No comments yet

Leave a comment