---
id: CVE-2026-109366
title: >-
  Zebra before 6.4.0 contains an improper integrity validation vulnerability in
  the inbound gossip download path that allows unauthenticated peers to force
  dropping of new blocks without penalty
summary: >-
  Zebra before 6.4.0 contains an improper integrity validation vulnerability in
  the inbound gossip download path that allows unauthenticated peers to force
  dropping of new blocks without penalty. Attackers can serve a real block with
  a coi…
severity: low
cvss: 3.7
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L'
cwe:
  - CWE-354
published: '2026-10-12'
updated: '2026-10-12'
sourceUpdated: '2026-10-12T17:17:34.393'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-109366'
references:
  - url: >-
      https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-4f6v-mj46-gxg3
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/zebra-before-6.4.0-gossiped-block-drop-via-forged-coinbase-scriptsig-height
    label: disclosure@vulncheck.com
tags:
  - nvd
  - cve.org
  - exploit-available
ingestedAt: '2026-10-12T18:00:08.215Z'
vendor: ZcashFoundation
product: zebra
affected:
  - zebra < 6.4.0
epss: 0.00157
epssPercentile: 0.048
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-26T20:37:04.530681Z'
---

## Overview

Zebra before 6.4.0 contains an improper integrity validation vulnerability in the inbound gossip download path that allows unauthenticated peers to force dropping of new blocks without penalty. Attackers can serve a real block with a coinbase scriptSig rewritten to height 1, which keeps the ZIP-244 block hash, triggering a behind-tip drop before consensus validation and delaying tip discovery for mining backends.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.