CVE-2026-104422: Insufficient Verification of Data Authenticity in ZcashFoundation zebra
The block sync download path in Zebra (zebrad) before 6.3.0 reads a block's height from its unvalidated coinbase scriptSig and drops blocks that appear too far behind the tip before consensus validation, without penalizing the supplying peer. Because V5 transaction IDs exclude the scriptSig, a malicious peer can repeatedly serve a canonical block whose coinbase claims height 1 while keeping the requested hash, delaying the node's discovery of the newest block.
AI Analysis
Technical Summary
Zebra (zebrad) versions before 6.3.0 have an insufficient verification of data authenticity vulnerability in the block sync download path. The software reads the block height from the coinbase scriptSig before consensus validation and drops blocks that seem too far behind the tip without penalizing the supplying peer. Because V5 transaction IDs exclude the scriptSig, an attacker can exploit this by serving a canonical block with a falsified low height in the coinbase scriptSig, causing the node to delay recognizing the newest block.
Potential Impact
This vulnerability allows a malicious peer to delay a node's synchronization with the latest blockchain state by repeatedly serving blocks that appear outdated based on their coinbase scriptSig height. This can disrupt timely block discovery and potentially affect node performance or network reliability. There is no indication of direct consensus compromise or data corruption, but the delay could impact node operation.
Mitigation Recommendations
A fix is available in Zebra version 6.3.0 and later. Users should upgrade to version 6.3.0 or newer to resolve this vulnerability. No additional mitigation steps are indicated in the provided data.
CVE-2026-104422: Insufficient Verification of Data Authenticity in ZcashFoundation zebra
Description
The block sync download path in Zebra (zebrad) before 6.3.0 reads a block's height from its unvalidated coinbase scriptSig and drops blocks that appear too far behind the tip before consensus validation, without penalizing the supplying peer. Because V5 transaction IDs exclude the scriptSig, a malicious peer can repeatedly serve a canonical block whose coinbase claims height 1 while keeping the requested hash, delaying the node's discovery of the newest block.
CVSS v4.0
Score 8.7high
Affected software
ZcashFoundation
zebra
pkg:github/zcashfoundation/zebraRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Zebra (zebrad) versions before 6.3.0 have an insufficient verification of data authenticity vulnerability in the block sync download path. The software reads the block height from the coinbase scriptSig before consensus validation and drops blocks that seem too far behind the tip without penalizing the supplying peer. Because V5 transaction IDs exclude the scriptSig, an attacker can exploit this by serving a canonical block with a falsified low height in the coinbase scriptSig, causing the node to delay recognizing the newest block.
Potential Impact
This vulnerability allows a malicious peer to delay a node's synchronization with the latest blockchain state by repeatedly serving blocks that appear outdated based on their coinbase scriptSig height. This can disrupt timely block discovery and potentially affect node performance or network reliability. There is no indication of direct consensus compromise or data corruption, but the delay could impact node operation.
Mitigation Recommendations
A fix is available in Zebra version 6.3.0 and later. Users should upgrade to version 6.3.0 or newer to resolve this vulnerability. No additional mitigation steps are indicated in the provided data.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-10-02T00:46:23.830Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6abf99afa43b0b3b89b26901
Added to database: 10/02/2026, 11:46:55 UTC
Last enriched: 10/02/2026, 12:16:28 UTC
Last updated: 10/03/2026, 03:09:41 UTC
Views: 5
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.