Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Release: ZcashFoundation zebra 6.4.0 Clear all filters
TI-2026-71182 CVE-2026-109366 · GHSA-mprq-2cjh-7qc2

Improper block validation in Zebra gossip lets peers drop new blocks

Priority MEDIUM 61

Zebra before 6.4.0 contains an improper integrity validation vulnerability in the inbound gossip download path that allows unauthenticated peers to force dropping of new blocks without penalty.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00157 Published 2026-10-12 Fixed in 6.4.0 CWE-354
TI-2026-71181 CVE-2026-109365 · GHSA-q5ww-8rv8-j2cv

Zebra accepts forged block bodies, enabling denial of service

Priority LOW 27

Zebra before 6.4.0 contains an uncontrolled resource consumption vulnerability that allows unauthenticated peers to force full proof verification by serving forged block bodies with valid header hashes.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.0015 Published 2026-10-12 Fixed in 6.4.0 CWE-345
TI-2026-71180 CVE-2026-109364 · GHSA-vw8x-hqvx-7q8q

Peer ban bypass in Zcash Zebra via exact-IP ban keying

Priority LOW 36

Zebra 2.3.0 before 6.4.0 contains a protection mechanism failure that allows unauthenticated peers to evade bans because bans and misbehavior scores are keyed on exact IP addresses.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00235 Published 2026-10-12 Fixed in 6.4.0 CWE-693