CVE-2026-109365

3.7Low

Published 12 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

3.7Low

Attack vector: Network
Complexity: High
Privileges needed: None
User interaction: None
Impact: Limited impact
Weakness: CWE-345

Impact

Remote, unauthenticated peers can stall node synchronization for over a minute by triggering expensive proof verifications. Attackers only need network connectivity to send forged block bodies with valid header hashes.

Root cause

The node verifies full cryptographic proofs for block bodies matching known header hashes before detecting that non-consensus authorizing bytes have been tampered with.

Affected systems

Zebra before 6.4.0

CVSS v3.1 · CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

Fix & remediation

Upgrade to Zebra version 6.4.0 or later. No interim configuration mitigation is specified, so you must update the node binary.

shell

$ cargo install --locked zebrad@6.4.0

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

Zebra before 6.4.0 contains an uncontrolled resource consumption vulnerability that allows unauthenticated peers to force full proof verification by serving forged block bodies with valid header hashes. Attackers can flip authorizing-only bytes such as a coinbase scriptSig, wasting Sapling, Orchard, and Ironwood proof verification without penalty and stalling sync for 67 seconds.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-109365