Medium
Zebra before 6.4.0 Denial of Service via Same-Hash Forged Block Bodies
Type: advisorySources: OSV
Zebra before 6.4.0 contains an uncontrolled resource consumption vulnerability that allows unauthenticated peers to force full proof verification by serving forged block bodies with valid header hashes. Attackers can flip authorizing-only bytes such as a coinbase scriptSig, wasting Sapling, Orchard, and Ironwood proof verification without penalty and stalling sync for 67 seconds.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2026-109365
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 4 Nov 2026, 13:54 UTC · Revision 1
Source evidence
Zebra before 6.4.0 Denial of Service via Same-Hash Forged Block Bodies
core-osv · Original sourcePublished 12 Oct 2026, 16:05 UTC
Zebra before 6.4.0 contains an uncontrolled resource consumption vulnerability that allows unauthenticated peers to force full proof verification by serving forged block bodies with valid header hashes. Attackers can flip authorizing-only bytes such as a coinbase scriptSig, wasting Sapling, Orchard, and Ironwood proof verification without penalty and stalling sync for 67 seconds.
osv:CVE-2026-109365
Complete source record
{
"id": "168b10ea4fa2a841bd2670c7480ab606a5057d9fed15c3183175a14cfc9d9630",
"url": "https://osv.dev/vulnerability/CVE-2026-109365",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "Zebra before 6.4.0 Denial of Service via Same-Hash Forged Block Bodies",
"summary": "Zebra before 6.4.0 contains an uncontrolled resource consumption vulnerability that allows unauthenticated peers to force full proof verification by serving forged block bodies with valid header hashes. Attackers can flip authorizing-only bytes such as a coinbase scriptSig, wasting Sapling, Orchard, and Ironwood proof verification without penalty and stalling sync for 67 seconds.",
"evidence": "osv:CVE-2026-109365",
"products": [],
"severity": "medium",
"structured": {
"id": "CVE-2026-109365",
"aliases": [
"CVE-2026-109365",
"GHSA-3c94-hf7p-g5mf"
],
"metrics": [
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/zcashfoundation/zebra",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "aedb094dc6dd13a0a565947e7ab4466a8b149d39"
}
],
"database_specific": {
"extracted_events": [
{
"range": [
{
"introduced": "0"
},
{
"fixed": "6.4.0"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandardRange"
},
{
"range": [
{
"introduced": "0"
},
{
"fixed": "6.4.0"
}
],
"source": "DESCRIPTION"
}
]
}
}
],
"versions": [
"zebra-utils-v10.0.1",
"zebra-state-v13.0.0",
"zebra-script-v11.0.0",
"zebra-rpc-v16.0.0",
"zebra-node-services-v10.0.0",
"zebra-network-v12.0.0",
"zebra-consensus-v15.0.0",
"zebra-chain-v12.0.0",
"v6.3.0",
"zebra-utils-v10.0.0",
"zebra-state-v12.0.1",
"zebra-script-v10.1.2",
"zebra-rpc-v15.0.0",
"zebra-node-services-v9.1.2",
"zebra-network-v11.0.0",
"zebra-consensus-v14.0.1",
"zebra-chain-v11.3.0",
"v6.2.3",
"zebra-utils-v9.1.4",
"zebra-state-v12.0.0",
"zebra-rpc-v14.0.0",
"zebra-network-v10.2.1",
"zebra-consensus-v14.0.0",
"v6.2.2",
"zebra-utils-v9.1.3",
"zebra-state-v11.1.1",
"zebra-rpc-v13.0.0",
"zebra-consensus-v13.0.0",
"v6.2.1",
"zebra-state-v11.1.0",
"zebra-network-v10.2.0",
"zebra-consensus-v12.0.1",
"v6.2.0",
"zebra-utils-v9.1.1",
"zebra-state-v11.0.0",
"zebra-script-v10.1.1",
"zebra-rpc-v12.0.0",
"zebra-node-services-v9.1.1",
"zebra-network-v10.1.1",
"zebra-consensus-v12.0.0",
"zebra-chain-v11.2.0",
"v6.1.0",
"tower-fallback-v0.2.43",
"tower-batch-control-v1.1.1",
"zebra-utils-v9.1.0",
"zebra-state-v10.1.0",
"zebra-script-v10.1.0",
"zebra-rpc-v11.1.0",
"zebra-node-services-v9.1.0",
"zebra-network-v10.1.0",
"zebra-consensus-v11.0.0",
"zebra-chain-v11.1.0",
"v6.0.0",
"tower-fallback-v0.2.42",
"tower-batch-control-v1.1.0",
"v6.0.0-rc.0",
"v5.2.0",
"v5.1.0",
"v5.1.1",
"v5.0.0",
"v4.5.1",
"v4.5.0",
"v4.4.0",
"v4.4.1",
"v4.3.1",
"4.3.1",
"v4.3.0",
"v4.2.0",
"v4.1.0",
"v4.0.0",
"v3.1.0",
"v3.0.0",
"v3.0.0-rc.0",
"v2.5.0",
"v2.0.1",
"v2.4.2",
"v2.3.0",
"v2.4.0",
"v2.0.0",
"v2.2.0",
"v2.1.0",
"v2.0.0-rc.0",
"v1.9.0",
"v1.8.0",
"v1.7.0",
"v1.6.1",
"v1.6.0",
"v1.5.2",
"v1.5.1",
"v1.5.0",
"v1.4.0",
"v1.3.0",
"v1.2.0",
"v1.1.0",
"v1.0.1",
"v1.0.0",
"v1.0.0-rc.9",
"v1.0.0-rc.8",
"v1.0.0-rc.7",
"v1.0.0-rc.6",
"v1.0.0-rc.5",
"v1.0.0-rc.0",
"v1.0.0-rc.4",
"v1.0.0-rc.3",
"v1.0.0-rc.2",
"v1.0.0-rc.1",
"v1.0.0-beta.15",
"v1.0.0-beta.14",
"v1.0.0-beta.13",
"v1.0.0-beta.12",
"v1.0.0-beta.11",
"v1.0.0-beta.10",
"v1.0.0-beta.9",
"v1.0.0-beta.8",
"v1.0.0-beta.7",
"v1.0.0-beta.6",
"v1.0.0-beta.5",
"v1.0.0-beta.4",
"v1.0.0-beta.3",
"v1.0.0-beta.2",
"v1.0.0-beta.1",
"v1.0.0-beta.0",
"v1.0.0-alpha.19",
"v1.0.0-alpha.18",
"v1.0.0-alpha.17",
"v1.0.0-alpha.16",
"v1.0.0-alpha.15",
"v1.0.0-alpha.14",
"v1.0.0-alpha.13",
"v1.0.0-alpha.12",
"v1.0.0-alpha.11",
"v1.0.0-alpha.10",
"v1.0.0-alpha.9",
"v1.0.0-alpha.8",
"v1.0.0-alpha.7",
"v1.0.0-alpha.6",
"v1.0.0-alpha.5",
"v1.0.0-alpha.4",
"v1.0.0-alpha.3",
"v1.0.0-alpha.2",
"v1.0.0-alpha.1",
"v1.0.0-alpha.0"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-109365.json"
}
}
],
"modified": "2026-10-28T02:30:36.044439214Z",
"provider": "osv",
"references": [
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/109xxx/CVE-2026-109365.json",
"https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-3c94-hf7p-g5mf",
"https://nvd.nist.gov/vuln/detail/CVE-2026-109365",
"https://www.vulncheck.com/advisories/zebra-before-6.4.0-denial-of-service-via-same-hash-forged-block-bodies"
],
"provider_metadata": {
"cwe_ids": [
"CWE-345"
],
"cna_assigner": "VulnCheck",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/109xxx/CVE-2026-109365.json"
}
},
"related_cves": [
{
"value": "CVE-2026-109365",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 503336,
"published_at": "2026-10-12T16:05:42.923+00:00"
}