TI-2026-71181 Aliases CVE-2026-109365 GHSA-q5ww-8rv8-j2cv

Zebra accepts forged block bodies, enabling denial of service

LOW 27CWE-345Published 2026-10-12 · Updated 2026-10-13

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Attack requirements: Present
Impact type: Security bypass
Confidentiality · integrity · availability: None · None · Low
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-345.

Summary

Zebra before 6.4.0 from ZcashFoundation contains a flaw where unauthenticated peers can serve block bodies with altered authorizing-only data, such as a coinbase scriptSig, while keeping valid header hashes. This flaw is classified as CWE-345, insufficient verification of data authenticity, because the node does not verify that the block body matches the header. An unauthenticated remote attacker can force full Sapling, Orchard, and Ironwood proof verification without penalty, which can stall synchronization for 67 seconds.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

Zebra before 6.4.0 contains an uncontrolled resource consumption vulnerability that allows unauthenticated peers to force full proof verification by serving forged block bodies with valid header hashes. Attackers can flip authorizing-only bytes such as a coinbase scriptSig, wasting Sapling, Orchard, and Ironwood proof verification without penalty and stalling sync for 67 seconds.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.0015 4th percentileScored 2026-11-07

Fix Fixed zebra (ZcashFoundation): 6.4.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
ZcashFoundation	zebra	before 6.4.0	6.4.0	Patch available	CNA

zebra VendorZcashFoundation Affected before 6.4.0 Fixed in 6.4.0 Patch available CNA

Remediation

Upgrade ZcashFoundation Zebra to version 6.4.0 or later, which fixes the flaw. The sources do not list a vendor advisory identifier for this fix.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Fix · CNA zebra (ZcashFoundation) Fixed in 6.4.0

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Release · 2026-10-12
ZcashFoundation zebra 6.4.0
3 records Highest priority Priority MEDIUM 1 MEDIUM, 2 LOW
Other records, highest priority first
- TI-2026-71182 Improper block validation in Zebra gossip lets peers drop new blocksPriority MEDIUM 61
- TI-2026-71180 Peer ban bypass in Zcash Zebra via exact-IP ban keyingPriority LOW 36
Show all 3 records →

Timeline

2026-10-12 Threatist record created from CVE-2026-109365
2026-10-12 Alias added: GHSA-q5ww-8rv8-j2cv
2026-10-13 Priority changed: MEDIUM → LOW
2026-10-13 CISA SSVC decision points changed

References

Advisory 1

GitHub Security Advisory (GHSA-3c94-hf7p-g5mf)

TI-2026-66079 Zebra before 4.4.0 Consensus Split via SIGHASH_SINGLE Missing-Output Handling CVSS 4.0HIGH 8.3
TI-2026-37850 ZEBRA: Mempool transaction admission denial via single-peer inbound queue saturation CVSS 3.1MEDIUM 5.3
TI-2026-71182 Improper block validation in Zebra gossip lets peers drop new blocks CVSS 4.0MEDIUM 6.3
TI-2026-29537 Zebra: addr/addrv2 Deserialization Resource Exhaustion CVSS 4.0MEDIUM 6.3
TI-2026-86702 Incomplete cleanup in Zebra lets peers stall initial sync CVSS 4.0HIGH 8.7
TI-2026-86701 Quadratic signature hashing in Zcash Zebra enables denial of service CVSS 4.0HIGH 8.7

See all 51 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences