CVE-2026-109366: Zebra before 6.4.0 Gossiped Block Drop via Forged Coinbase scriptSig Height
Zebra before 6.4.0 contains an improper integrity validation vulnerability in the inbound gossip download path that allows unauthenticated peers to force dropping of new blocks without penalty. Attackers can serve a real block with a coinbase scriptSig rewritten to height 1, which keeps the ZIP-244 block hash, triggering a behind-tip drop before consensus validation and delaying tip discovery for mining backends.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any unauthenticated network peer can attempt the attack. Exploitation requires serving a real block whose coinbase scriptSig has been rewritten to claim height 1.
What is the operational impact?
Affected nodes can drop new gossiped blocks before consensus validation and do not penalize the peer that supplied them. This can delay tip discovery for mining backends, resulting in an availability impact rather than confidentiality or integrity loss.
Are default network-facing deployments affected?
The issue is in the inbound gossip download path and can be triggered by unauthenticated peers, so deployments that accept inbound peer gossip are exposed. The provided information does not identify any configuration prerequisite beyond receiving gossip from peers.
What versions need remediation?
Zebra versions before 6.4.0 are affected. Updating to version 6.4.0 or later addresses the affected version range described here.