CVE-2026-109365: Zebra before 6.4.0 Denial of Service via Same-Hash Forged Block Bodies
Zebra before 6.4.0 contains an uncontrolled resource consumption vulnerability that allows unauthenticated peers to force full proof verification by serving forged block bodies with valid header hashes. Attackers can flip authorizing-only bytes such as a coinbase scriptSig, wasting Sapling, Orchard, and Ironwood proof verification without penalty and stalling sync for 67 seconds.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Zcash Foundation Zebra deployments running a version before 6.4.0 are affected. The issue can stall synchronization by causing expensive proof verification work.
Does exploitation require authentication or user interaction?
No. An unauthenticated peer can trigger the issue remotely, and no user interaction is required.
What does an attacker need to send to trigger the resource consumption?
The attacker needs to serve forged block bodies whose header hashes remain valid. They can alter authorizing-only data, such as a coinbase scriptSig, to force Sapling, Orchard, and Ironwood proof verification.
What is the observed impact on a vulnerable node?
The supplied information states that a successful attack can waste proof-verification resources without penalty and stall synchronization for 67 seconds.