TI-2026-71179 Aliases CVE-2026-109363 GHSA-47j7-v7c6-f9jg

Reachable assertion in Zebra lets peers crash the node

MEDIUM 44CWE-617Published 2026-10-12 · Updated 2026-10-13

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: Denial of service
Confidentiality · integrity · availability: None · None · High
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-617.

Summary

ZcashFoundation Zebra from 6.4.0 before 6.4.2 mishandles version 6 transactions that carry a pre-NU6.3 consensus branch ID. The size computation treats re-serialization of the Orchard bundle as infallible, so a resulting error trips an expect that aborts zebrad (CWE-617). Unauthenticated peers can crash the node with a single pre-handshake tx message, and they can repeat this after each restart.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

ZcashFoundation Zebra 6.4.0 before 6.4.2 parses version 6 transactions carrying a pre-NU6.3 consensus branch ID, but the size computation during UnminedTx construction treats re-serialization of the Orchard bundle as infallible, so the resulting error trips an expect that aborts zebrad. Unauthenticated peers can send a single pre-handshake tx message to crash the node, and can repeat this after each restart.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00432 37th percentileScored 2026-11-07

Fix Fixed zebra (ZcashFoundation): 6.4.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
ZcashFoundation	zebra	6.4.0 to before 6.4.2	6.4.2	Patch available	CNA

zebra VendorZcashFoundation Affected 6.4.0 to before 6.4.2 Fixed in 6.4.2 Patch available CNA

Remediation

Upgrade ZcashFoundation Zebra to version 6.4.2, which fixes this issue. The sources list no other fixed version for zebra.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Fix · CNA zebra (ZcashFoundation) Fixed in 6.4.2

Timeline

2026-10-12 Threatist record created from CVE-2026-109363
2026-10-12 Alias added: GHSA-47j7-v7c6-f9jg
2026-10-13 Priority changed: MEDIUM → LOW
2026-10-13 CISA SSVC decision points changed
2026-10-13 Priority changed: LOW → MEDIUM

References

Patch 1

Patch Commit

Advisory 1

GitHub Security Advisory (GHSA-h5rr-8pqv-grp9)

TI-2026-66079 Zebra before 4.4.0 Consensus Split via SIGHASH_SINGLE Missing-Output Handling CVSS 4.0HIGH 8.3
TI-2026-37850 ZEBRA: Mempool transaction admission denial via single-peer inbound queue saturation CVSS 3.1MEDIUM 5.3
TI-2026-71182 Improper block validation in Zebra gossip lets peers drop new blocks CVSS 4.0MEDIUM 6.3
TI-2026-29537 Zebra: addr/addrv2 Deserialization Resource Exhaustion CVSS 4.0MEDIUM 6.3
TI-2026-86702 Incomplete cleanup in Zebra lets peers stall initial sync CVSS 4.0HIGH 8.7
TI-2026-86701 Quadratic signature hashing in Zcash Zebra enables denial of service CVSS 4.0HIGH 8.7

See all 51 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences