CVE-2026-109363: Zebra 6.4.0 before 6.4.2 Denial of Service via Malformed v6 Transaction
ZcashFoundation Zebra 6.4.0 before 6.4.2 parses version 6 transactions carrying a pre-NU6.3 consensus branch ID, but the size computation during UnminedTx construction treats re-serialization of the Orchard bundle as infallible, so the resulting error trips an expect that aborts zebrad. Unauthenticated peers can send a single pre-handshake tx message to crash the node, and can repeat this after each restart.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ZcashFoundation Zebrato a version that resolves this vulnerability.Fixed in 6.4.2
Event History
Frequently Asked Questions
Which deployments are exposed to this denial of service?
ZcashFoundation Zebra versions 6.4.0 before 6.4.2 are affected. A reachable zebrad node is exposed because an unauthenticated peer can send the triggering transaction message over the network.
Does exploiting this require authentication or a completed peer handshake?
No. An unauthenticated peer can trigger the crash with a single pre-handshake transaction message, so no completed handshake is required.
What is the operational impact of a successful attack?
The malformed version 6 transaction causes zebrad to abort. An attacker can repeat the attack after each node restart, allowing persistent denial of service.