Vulnerability · Published Oct 12, 2026 · Assigned by VulnCheck

CVE-2026-109366Zebra before 6.4.0 Gossiped Block Drop via Forged Coinbase scriptSig Height

Low 3.7

In plain English

A low-severity security flaw in zebra from ZcashFoundation. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 5% of all known vulnerabilities).

Severity (CVSS 3.1)3.7Low

Exploit odds (30 days)0.2%top 95.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Zebra before 6.4.0 contains an improper integrity validation vulnerability in the inbound gossip download path that allows unauthenticated peers to force dropping of new blocks without penalty. Attackers can serve a real block with a coinbase scriptSig rewritten to height 1, which keeps the ZIP-244 block hash, triggering a behind-tip drop before consensus validation and delaying tip discovery for mining backends.

Affected products (as reported)

Vendor	Product	Versions
ZcashFoundation	zebra	0 – before 6.4.0

Weakness: CWE-354 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

References

GitHub Security Advisory (GHSA-4f6v-mj46-gxg3) vendor-advisory
VulnCheck Advisory: Zebra before 6.4.0 Gossiped Block Drop via Forged Coinbase scriptSig Height third-party-advisory