Zebra before 6.4.0 Gossiped Block Drop via Forged Coinbase scriptSig Height
Zebra before 6.4.0 contains an improper integrity validation vulnerability in the inbound gossip download path that allows unauthenticated peers to force dropping of new blocks without penalty. Attackers can serve a real block with a coinbase scriptSig rewritten to height 1, which keeps the ZIP-244 block hash, triggering a behind-tip drop before consensus validation and delaying tip discovery for mining backends.
CVE-2026-109366
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-109366
zebra
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"vendor": "ZcashFoundation",
"product": "zebra",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "6.4.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "6.4.0",
"versionType": "semver"
}
],
"packageURL": "pkg:cargo/zebrad",
"defaultStatus": "unaffected"
}
]- Related CVEs
- CVE-2026-109366
Source reference:
/cveMetadata/cveId
Publisher severity
medium
Source reference: /containers/cna/metrics
- Event
- #17087 · Revision 1
- Added to Heist Feed
- Publisher date