CVE-2026-109366CWE-354

CVE-2026-109366

Low · published October 12, 2026

CVSS v3.1
3.7
EPSS
0%
Percentile
4.5
In the wild
Unconfirmed
What it is

Zebra before 6.4.0 contains an improper integrity validation vulnerability in the inbound gossip download path that allows unauthenticated peers to force dropping of new blocks without penalty. Attackers can serve a real block with a coinbase scriptSig rewritten to height 1, which keeps the ZIP-244 block hash, triggering a behind-tip drop before consensus validation and delaying tip discovery for mining backends.

The record
Technical detail
CVSS v3.1
3.7 · LOW
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
CVSS v4.0
6.3 · CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
EPSS
0.00157 · 4.5th percentile
Weakness
CWE-354 · Improper Validation of Integrity Check Value
Published
2026-10-12T21:17Z
References (2)
https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-4f6v-mj46-gxg3 · [email protected]https://www.vulncheck.com/advisories/zebra-before-6.4.0-gossiped-block-drop-via-forged-coinbase-scriptsig-height · [email protected]
EPSS history
Timeline
  • 14 OCT 03:27Z
    EPSS moved — → 0%
    epss
  • 12 OCT 16:05Z
    Zebra before 6.4.0 Gossiped Block Drop via Forged Coinbase scriptSig Height
    cvelistv5
  • 12 OCT 16:05Z
    Zebra before 6.4.0 Gossiped Block Drop via Forged Coinbase scriptSig Height
    cvelistv5