CVE-2026-109363
Received Received - Intake

Zebra Node Crash via Malformed Orchard Transaction

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: VulnCheck

Description
ZcashFoundation Zebra 6.4.0 before 6.4.2 parses version 6 transactions carrying a pre-NU6.3 consensus branch ID, but the size computation during UnminedTx construction treats re-serialization of the Orchard bundle as infallible, so the resulting error trips an expect that aborts zebrad. Unauthenticated peers can send a single pre-handshake tx message to crash the node, and can repeat this after each restart.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-12
Last Modified
2026-10-12
Generated
2026-10-12
AI Q&A
2026-10-12
EPSS Evaluated
N/A
NVD
CVE-2026-109363
EUVD
EUVD-2026-97665

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
ZcashFoundation zebra 6.4.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-617 The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

ZcashFoundation Zebra 6.4.0 before 6.4.2 has a flaw in transaction parsing. When processing version 6 transactions with a pre-NU6.3 consensus branch ID, the size computation during UnminedTx construction incorrectly assumes the Orchard bundle re-serialization cannot fail. This leads to an error that triggers an abort in zebrad. Unauthenticated peers can exploit this by sending a single pre-handshake transaction message to crash the node, and they can repeat this attack after each restart.

Detection Guidance

This vulnerability can be detected by checking the Zebra node version. If you are running Zebra 6.4.0 before 6.4.2, your system is vulnerable. Use the command 'zebrad --version' to check the installed version.

Impact Analysis

This vulnerability allows unauthenticated attackers to crash Zebra nodes by sending a malformed transaction. If you operate a Zcash node using affected Zebra versions, your node may become unavailable, disrupting network participation and transaction processing. Repeated crashes could lead to prolonged downtime.

Mitigation Strategies

Upgrade Zebra to version 6.4.2 or later immediately. Stop using vulnerable versions and restart the node after upgrading to prevent crashes from malicious transactions.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-109363. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart