Vulnerability · Published Oct 2, 2026 · Assigned by VulnCheck

CVE-2026-104422Zebra before 6.3.0 Block Sync Denial of Service via Coinbase scriptSig Rewrite

High 7.5

In plain English

A high-severity insufficient verification of data authenticity in zebra from ZcashFoundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 7% of all known vulnerabilities).

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)0.2%top 92.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

The block sync download path in Zebra (zebrad) before 6.3.0 reads a block's height from its unvalidated coinbase scriptSig and drops blocks that appear too far behind the tip before consensus validation, without penalizing the supplying peer. Because V5 transaction IDs exclude the scriptSig, a malicious peer can repeatedly serve a canonical block whose coinbase claims height 1 while keeping the requested hash, delaying the node's discovery of the newest block.

Affected products (as reported)

Vendor	Product	Versions
ZcashFoundation	zebra	0 – before 6.3.0

Weakness: CWE-345 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

GitHub Security Advisory (GHSA-g95h-hw6g-pvgv) vendor-advisory
VulnCheck Advisory: Zebra before 6.3.0 Block Sync Denial of Service via Coinbase scriptSig Rewrite third-party-advisory