CVE-2026-109366
3.7LowPublished 12 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
- Impact
- Limited impact
- Weakness
- CWE-354
Impact
Remote, unauthenticated network peers can delay block tip discovery for mining backends by forcing Zebra to silently drop new valid blocks. Attackers only need network connectivity to the inbound gossip protocol.
Root cause
The inbound gossip download path checks block height using an unverified coinbase scriptSig before running consensus validation, dropping blocks when the scriptSig is rewritten to height 1 even though the block hash matches.
Affected systems
Zebra before 6.4.0
CVSS v3.1 · CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Fix & remediation
Upgrade Zebra to version 6.4.0 or later. No workarounds or interim mitigations are provided.
$ cargo install --locked zebrad --version 6.4.0AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Zebra before 6.4.0 contains an improper integrity validation vulnerability in the inbound gossip download path that allows unauthenticated peers to force dropping of new blocks without penalty. Attackers can serve a real block with a coinbase scriptSig rewritten to height 1, which keeps the ZIP-244 block hash, triggering a behind-tip drop before consensus validation and delaying tip discovery for mining backends.