Vulnerability · Published Oct 12, 2026 · Assigned by VulnCheck

CVE-2026-109365Zebra before 6.4.0 Denial of Service via Same-Hash Forged Block Bodies

Low 3.7

In plain English

A low-severity insufficient verification of data authenticity in zebra from ZcashFoundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 4% of all known vulnerabilities).

Severity (CVSS 3.1)3.7Low

Exploit odds (30 days)0.1%top 95.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Zebra before 6.4.0 contains an uncontrolled resource consumption vulnerability that allows unauthenticated peers to force full proof verification by serving forged block bodies with valid header hashes. Attackers can flip authorizing-only bytes such as a coinbase scriptSig, wasting Sapling, Orchard, and Ironwood proof verification without penalty and stalling sync for 67 seconds.

Affected products (as reported)

Vendor	Product	Versions
ZcashFoundation	zebra	0 – before 6.4.0

Weakness: CWE-345 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

References

GitHub Security Advisory (GHSA-3c94-hf7p-g5mf) vendor-advisory
VulnCheck Advisory: Zebra before 6.4.0 Denial of Service via Same-Hash Forged Block Bodies third-party-advisory