MEDIUM 6.3 NVD
CVE-2026-109366
Zebra before 6.4.0 contains an improper integrity validation vulnerability in the inbound gossip download path that allows unauthenticated peers to force droppi
Zebra before 6.4.0 contains an improper integrity validation vulnerability in the inbound gossip download path that allows unauthenticated peers to force dropping of new blocks without penalty. Attackers can serve a real block with a coinbase scriptSig rewritten to height 1, which keeps the ZIP-244 block hash, triggering a behind-tip drop before consensus validation and delaying tip discovery for mining backends.
References
- https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-4f6v-mj46-gxg3
- https://www.vulncheck.com/advisories/zebra-before-6.4.0-gossiped-block-drop-via-forged-coi
This medium severity vulnerability with a CVSS score of 6.3 was published on 2026-10-12 via NVD.
vulnfeed aggregates 10929 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.