CVE-2026-109365

LOWCVSS 3.7

Description

Zebra before 6.4.0 contains an uncontrolled resource consumption vulnerability that allows unauthenticated peers to force full proof verification by serving forged block bodies with valid header hashes. Attackers can flip authorizing-only bytes such as a coinbase scriptSig, wasting Sapling, Orchard, and Ironwood proof verification without penalty and stalling sync for 67 seconds.

Timeline

Published:October 12th, 2026 5:17 PM

Last modified:October 15th, 2026 8:31 PM

CVSS Scoring

CVSS v3: 3.7 (LOW)

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

Weaknesses (CWE)

CWE-345

References & Reports

Advisories, patches, and third-party reports

https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-3c94-hf7p-g5mf
https://www.vulncheck.com/advisories/zebra-before-6.4.0-denial-of-service-via-same-hash-forged-block-bodies

Source: NIST NVD · Data may lag official sources by up to one minute