CVE-2026-109366
Received Received - Intake

Zebra Improper Integrity Validation Leading to Block Drop

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: VulnCheck

Description
Zebra before 6.4.0 contains an improper integrity validation vulnerability in the inbound gossip download path that allows unauthenticated peers to force dropping of new blocks without penalty. Attackers can serve a real block with a coinbase scriptSig rewritten to height 1, which keeps the ZIP-244 block hash, triggering a behind-tip drop before consensus validation and delaying tip discovery for mining backends.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-12
Last Modified
2026-10-12
Generated
2026-10-12
AI Q&A
2026-10-12
EPSS Evaluated
N/A
NVD
CVE-2026-109366
EUVD
EUVD-2026-97668

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
ZcashFoundation zebra 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-354 The product does not validate or incorrectly validates the integrity check values or "checksums" of a message. This may prevent it from detecting if the data has been modified or corrupted in transmission.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in Zebra before 6.4.0 allows unauthenticated peers to manipulate the inbound gossip download path by serving a real block with a modified coinbase scriptSig set to height 1. This keeps the ZIP-244 block hash unchanged but triggers a behind-tip drop before consensus validation, delaying tip discovery for mining backends.

Detection Guidance

Detecting this vulnerability requires monitoring Zebra node logs for repeated block drops with forged coinbase scriptSig heights. Check for blocks dropped as 'behind tip' without proper penalties applied to peers. Use Zebra's debug RPC commands to inspect gossip traffic and block validation logs for inconsistencies in block heights.

Impact Analysis

Attackers could exploit this to delay block propagation, potentially causing network instability or reduced mining efficiency. Mining backends may experience delays in discovering new blocks, affecting operations dependent on timely block validation.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR or HIPAA as it pertains to blockchain node software integrity rather than data protection or privacy. The issue involves delayed block discovery in Zcash's Zebra node, which may impact mining operations but does not involve unauthorized data access or processing.

Mitigation Strategies

Upgrade Zebra to version 6.4.0 or later to address the improper integrity validation flaw in the gossip download path.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-109366. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart